9661762b367c9b9914e02a274fce181229109e5ddadb224a2dd9e047c35c28e5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 05:36

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

101KB
MD5

5b7d3fc9651089f373df83a9bdc922a7
SHA1

e0ee059b261e89bef6bdc9392ea4a579686a410f
SHA256

cb1e6695c6d55c3bd4b8d12cbe6a2e48687e72c84223256a3431560b2d4d7e59
SHA512

5feaf4de80e9057c9b3fc2d5ef2a5b7ef857fa7de67e5e5aa56915d06cd42b8544a8e707140bf182ad4907fc51a022fa597316f27e481abe170ba2548d64f911
SSDEEP

1536:D3h2lAZyQr64O173t81vfTvkrkuV4OclyTJafC1:Lh2l0yG6Z3O13y4OcluUC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	2312	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2420 wrote to memory of 2312	2420	rundll32.exe	28
PID 2312 wrote to memory of 1256	2312	rundll32.exe	29
PID 2312 wrote to memory of 1256	2312	rundll32.exe	29
PID 2312 wrote to memory of 1256	2312	rundll32.exe	29
PID 2312 wrote to memory of 1256	2312	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 228
    3⤵
    - Program crash
    PID:1256