209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 23:55

Target

$PLUGINSDIR/NSIS_HTTPRequest.dll
Size

55KB
MD5

52033e4f012b5ea9e6a2a719c5a9f2bf
SHA1

14ae0a9600997b77057a6c07bdf0ad974971fc01
SHA256

00b7b5c1addeb7404089cb44743701614717723397790a73a48118aecbc423b4
SHA512

d3101723c485a28d1871ca49656b19681a36cee459d061ba8a66a97ead9e5d87d635bee912ebbcd5d743f1d562d4dbe0952d97987b7016fd0a6f54dacbc95f45
SSDEEP

768:fRkeem9aVIuOdDSzL3cMSWVEDaoWX6P+QL3H6WesAAZz6Fi5RvJt:fHemOIuOQ/ZtEpW6TWAZJ5Rv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2700	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2668 wrote to memory of 2700	2668	rundll32.exe	27
PID 2700 wrote to memory of 2664	2700	rundll32.exe	28
PID 2700 wrote to memory of 2664	2700	rundll32.exe	28
PID 2700 wrote to memory of 2664	2700	rundll32.exe	28
PID 2700 wrote to memory of 2664	2700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSIS_HTTPRequest.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSIS_HTTPRequest.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 232
    3⤵
    - Program crash
    PID:2664