209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 23:55

Target

$PLUGINSDIR/NSIS_HTTPRequest.dll
Size

55KB
MD5

52033e4f012b5ea9e6a2a719c5a9f2bf
SHA1

14ae0a9600997b77057a6c07bdf0ad974971fc01
SHA256

00b7b5c1addeb7404089cb44743701614717723397790a73a48118aecbc423b4
SHA512

d3101723c485a28d1871ca49656b19681a36cee459d061ba8a66a97ead9e5d87d635bee912ebbcd5d743f1d562d4dbe0952d97987b7016fd0a6f54dacbc95f45
SSDEEP

768:fRkeem9aVIuOdDSzL3cMSWVEDaoWX6P+QL3H6WesAAZz6Fi5RvJt:fHemOIuOQ/ZtEpW6TWAZJ5Rv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	1100	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1100	856	rundll32.exe	86
PID 856 wrote to memory of 1100	856	rundll32.exe	86
PID 856 wrote to memory of 1100	856	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSIS_HTTPRequest.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSIS_HTTPRequest.dll,#1
  2⤵
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 612
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1100 -ip 1100
1⤵
PID:1236