72868be491abbe90162c5dc1bf7e0b2adbfeb6061abee1c324077cf14aecc36c

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 04:15

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

88bbaee1059dcba83cce60777e90a423
SHA1

a0369b986bed181c9cbd70e573754d48f7930119
SHA256

19add6d77910f00709d52d1118765d9117246beb3d40ed227376e3a8380f8307
SHA512

9d6160ff34c6a7c9e91102374abd6611defc9588c7ce7dd8238d4023b2db79ff127aad9dbbffae68651de9e8206acced33b9960ca4a21eb7e6dcd6aa8c39c805
SSDEEP

192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPbsfA:6Bo/680dCI5adOjFOg9//p27uNw27o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3128	1800	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1800	1540	rundll32.exe	86
PID 1540 wrote to memory of 1800	1540	rundll32.exe	86
PID 1540 wrote to memory of 1800	1540	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 624
    3⤵
    - Program crash
    PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1800 -ip 1800
1⤵
PID:3220