126e5553fc40e4ecd36dbbedfbb39cced9b956b224122fe9df25f5d86081628f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 16:42

Target

$PLUGINSDIR/nsisdl.dll
Size

15KB
MD5

dd893b05df4fae0be652dfb188cd02d1
SHA1

a93eed746ad7c87e84e95594b928236eac4c6aed
SHA256

334697f5ae532cbd6274a17f2009d21acdece8e21735cb16cf2c09262be7cfa2
SHA512

baaa24e1deea742298ed4a361f70b568106fe462b71689b6394daa805ae898f246b4d417a176f66aec192ae0d64bafee555bb95388e02d3304b4a73a2f2f42f4
SSDEEP

384:Ahyd8Y6pu8ZaLf6Uksnw1g8BUcyHisULb:Ahyd8Y67WGg8B/Eib

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	1652	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 1652 wrote to memory of 320	1652	rundll32.exe	29
PID 1652 wrote to memory of 320	1652	rundll32.exe	29
PID 1652 wrote to memory of 320	1652	rundll32.exe	29
PID 1652 wrote to memory of 320	1652	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 224
    3⤵
    - Program crash
    PID:320