271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8

Resubmissions

29-02-2024 21:17

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 21:17

Target

$PLUGINSDIR/NsisInstallUI.dll
Size

2.1MB
MD5

7aad5c0c2a4a8e2d4f6c463b63dc0609
SHA1

f257472d5a8e441c9300a9e4dd63f6b559a98bd0
SHA256

03e2ac88d13ab95dbe53b037c458cc57e3ada6153022d9d2a4097aea938f89b6
SHA512

418498124c939a44fb1bf3ce9113bed5cf419475c430e566e93a7c493037f788d82edb4318a4f9f833e1ffb6f3dbeb145ad3ccb82517ecf4cb82bac64dd42ccf
SSDEEP

12288:ejH0Y1jL7JZ8RJK6Kml2wt0G9/V430NrHbukH2Dh5ccEudZrRkycQq7j2EqcPmqd:e70WppHmPh7R7JBBFmqQVLwS9/eTFsOf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3112	220	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 220	4784	rundll32.exe	88
PID 4784 wrote to memory of 220	4784	rundll32.exe	88
PID 4784 wrote to memory of 220	4784	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 640
    3⤵
    - Program crash
    PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 220 -ip 220
1⤵
PID:2436