134852590ab19f2a8d8de08fd653bdaa58f6408c318ed9314771585777faac1d

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 06:26

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

88bbaee1059dcba83cce60777e90a423
SHA1

a0369b986bed181c9cbd70e573754d48f7930119
SHA256

19add6d77910f00709d52d1118765d9117246beb3d40ed227376e3a8380f8307
SHA512

9d6160ff34c6a7c9e91102374abd6611defc9588c7ce7dd8238d4023b2db79ff127aad9dbbffae68651de9e8206acced33b9960ca4a21eb7e6dcd6aa8c39c805
SSDEEP

192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPbsfA:6Bo/680dCI5adOjFOg9//p27uNw27o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3280	1844	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1844	3016	rundll32.exe	84
PID 3016 wrote to memory of 1844	3016	rundll32.exe	84
PID 3016 wrote to memory of 1844	3016	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 624
    3⤵
    - Program crash
    PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1844 -ip 1844
1⤵
PID:5096