f64de4aee0bc21db63da573ccb97b7d9a8d1e8dfc29bef72d8c8f26c4ec640cc

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 03:49

Target
$PLUGINSDIR/NSISdl.dll
Size 12KB
Sample240203-edmf8sgdc9
SHA256 17055e463a04435bdb5fea5d634af12a4678ff5d680196da230879ad24622ee3
MD5 a10c9c9f5474ed8c13ff5e182655eb9f
SHA1 ffa6073f6b1724183d570c368c3025430de1ee33
SHA512 bd7222d4ee6516b9be7f498858812ebfa824f657ef5298cfc813ad91fdfb6129642232d4c47f2edc4c2b8d2619ba7530a5195d53e9017435e7e8ef742f60fdb5
SSDEEP 192:ATPN9E1B0OUrW7VymsS9WmaYqkzJqa5Maamy6J0WVpzuzzPzrR2Z+:ATzEbUrW9tWmaY/zJ+aFy6CWVUzDP8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2900	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 1152 wrote to memory of 2900	1152	rundll32.exe	28
PID 2900 wrote to memory of 2984	2900	rundll32.exe	29
PID 2900 wrote to memory of 2984	2900	rundll32.exe	29
PID 2900 wrote to memory of 2984	2900	rundll32.exe	29
PID 2900 wrote to memory of 2984	2900	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 228
    3⤵
    - Program crash
    PID:2984