22987c398c668599e79f7f89a3d6b92a9c9f2d9dec98cbbea2e1ab5e6d3edbff

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 19:30

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

f74ab11bda41d22bd80224643e04b5f9
SHA1

ea7a67987074ff6478d230d3d77253ee6d4bf230
SHA256

7fce1d6bb1c59f47a789468a382a3461fe257b0579c8f91a8a666eb728f9c03b
SHA512

251a158c189497def370a9a519a59264e15dee09890bc0806e1e7e1b9246255be17727e683eb95228be6143bfae1ee70f8d500b4df623d202427e99b8a6dc6c9
SSDEEP

1536:Iy5ZZpmn2orlR1mM+g5P6gP6uvpPbxYezUANRL1zaeuDJmi35QAhrsXvfDbFaob:IyanH9GrE17cDJmiJQ8q3Dko

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3952	2328	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2328	4852	rundll32.exe	84
PID 4852 wrote to memory of 2328	4852	rundll32.exe	84
PID 4852 wrote to memory of 2328	4852	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 600
    3⤵
    - Program crash
    PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2328 -ip 2328
1⤵
PID:2384