693eb22b127e018b4eadc3246a65063488db8d38a9938eb1951ec3e53cec646b | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 09:20

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/NSISPlugin.dll
Size

1.0MB
MD5

362eddf4162293770bcff8fa9bfabb7f
SHA1

aa80ab76aac054e6c3ebb2487ce396f92e97dc21
SHA256

f2b73ba3ca42dd9097727f6e0aabfa63b566c2d78be0d41791d72c6d16240d78
SHA512

cbf4ba93afb6a9d6ac0a6a1cfef473d163b59e7737bb644e358ec6107a4730bd0cadfba6b8baeb2a597a8af90d5c861f6441b3d4f78873a06a82872af14a2e36
SSDEEP

24576:Ix8E92oL6HJRtUj9xcSI338TzMQyK/O0:8H28BPYcTAQyKX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4480	3060	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3060	1248	rundll32.exe	87
PID 1248 wrote to memory of 3060	1248	rundll32.exe	87
PID 1248 wrote to memory of 3060	1248	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 648
    3⤵
    - Program crash
    PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3060 -ip 3060
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads