134852590ab19f2a8d8de08fd653bdaa58f6408c318ed9314771585777faac1d

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 06:26

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

88bbaee1059dcba83cce60777e90a423
SHA1

a0369b986bed181c9cbd70e573754d48f7930119
SHA256

19add6d77910f00709d52d1118765d9117246beb3d40ed227376e3a8380f8307
SHA512

9d6160ff34c6a7c9e91102374abd6611defc9588c7ce7dd8238d4023b2db79ff127aad9dbbffae68651de9e8206acced33b9960ca4a21eb7e6dcd6aa8c39c805
SSDEEP

192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPbsfA:6Bo/680dCI5adOjFOg9//p27uNw27o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2172	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2212 wrote to memory of 2172	2212	rundll32.exe	28
PID 2172 wrote to memory of 2968	2172	rundll32.exe	29
PID 2172 wrote to memory of 2968	2172	rundll32.exe	29
PID 2172 wrote to memory of 2968	2172	rundll32.exe	29
PID 2172 wrote to memory of 2968	2172	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 228
    3⤵
    - Program crash
    PID:2968