20d91430397028cb83296e7a41598414c9a4ef272afba435196d231a8cbd0b67

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 00:38

Target

$PLUGINSDIR/NSISdl.dll
Size

15KB
MD5

ba2cc9634ebed71cea697a31144af802
SHA1

8221c522b24f4808f66a476381db3e6455eab5c3
SHA256

9a3c2fe5490c34f73f1a05899ef60cfef05e0c9599cd704e524ef7a46ead67ba
SHA512

dcc74bcedd9402f7ac7e2d1872fe0e2876ae93cf8bbd869d5b9b7b56cea244ba8d2891fa2b51382092b86480337936f5ec495d9005d47fbfd9e2b71cb7f6ba8f
SSDEEP

384:Zhyd8Y6pu8ZaLf6Uksnw1g8BUcyHisUVb:Zhyd8Y67WGg8B/EiF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	2020	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 3024 wrote to memory of 2020	3024	rundll32.exe	28
PID 2020 wrote to memory of 2112	2020	rundll32.exe	29
PID 2020 wrote to memory of 2112	2020	rundll32.exe	29
PID 2020 wrote to memory of 2112	2020	rundll32.exe	29
PID 2020 wrote to memory of 2112	2020	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 224
    3⤵
    - Program crash
    PID:2112