271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8

Resubmissions

29-02-2024 21:17

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 21:17

Target

$PLUGINSDIR/NsisInstallUI.dll
Size

2.1MB
MD5

7aad5c0c2a4a8e2d4f6c463b63dc0609
SHA1

f257472d5a8e441c9300a9e4dd63f6b559a98bd0
SHA256

03e2ac88d13ab95dbe53b037c458cc57e3ada6153022d9d2a4097aea938f89b6
SHA512

418498124c939a44fb1bf3ce9113bed5cf419475c430e566e93a7c493037f788d82edb4318a4f9f833e1ffb6f3dbeb145ad3ccb82517ecf4cb82bac64dd42ccf
SSDEEP

12288:ejH0Y1jL7JZ8RJK6Kml2wt0G9/V430NrHbukH2Dh5ccEudZrRkycQq7j2EqcPmqd:e70WppHmPh7R7JBBFmqQVLwS9/eTFsOf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 2928 wrote to memory of 3000	2928	rundll32.exe	27
PID 3000 wrote to memory of 2516	3000	rundll32.exe	30
PID 3000 wrote to memory of 2516	3000	rundll32.exe	30
PID 3000 wrote to memory of 2516	3000	rundll32.exe	30
PID 3000 wrote to memory of 2516	3000	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 236
    3⤵
    - Program crash
    PID:2516