24e55672ff54a0e1339ed46d65d67f5a2a5b10845f657550085fd6988e50fb86

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 10:50

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

adfda3dea5752f2244cb506cea456152
SHA1

31c900f17a3f82801e88102f3215710ac9ca3ea4
SHA256

0950e3994d4b7a073936a9231838f5b3a94dbd161214c44095e2037567801b91
SHA512

16e39d4ac13be7a4b58f5e29e62bc58531ce2c095e0035a900c56802563503f8b03ba1d12754cf48a29ec8fae5ddd7932fb9159481440432184b74a4c8521671
SSDEEP

1536:Xy5ZZpmn2orlR1mM+g5P6gP6uvpPbxYezUANRL1zaeuDJmi35QAWrsnvfPbFaob:XyanH9GrE17cDJmiJQXW3Pko

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	2504	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2504	3856	rundll32.exe	89
PID 3856 wrote to memory of 2504	3856	rundll32.exe	89
PID 3856 wrote to memory of 2504	3856	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 604
    3⤵
    - Program crash
    PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2504 -ip 2504
1⤵
PID:4144