09f74ca0de08a2181671b49c9f399fdcfbcc8d21f08d216bbdbbb4501104f57a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:06

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

36bd5fe93cba28f56faa83b84833d33f
SHA1

f45d3207fb707c6a768cb5799fcc04da13503b79
SHA256

6da03a7b9dc18a940c910903c31b09934bfcac582aabbb2fe081e540098b1d54
SHA512

0dd06cb7d521980fca53bb4c3def3670b847291236dcf2c802b41b94c69e17e43cc16c8672b5af4f2c00d2732e3685e80171ca579cef9f0b44c4fee56caba58e
SSDEEP

192:T4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12hgszA:TysdM80dCI5a2LsQ5IlPNRY00AlAfU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2976	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2208 wrote to memory of 2976	2208	rundll32.exe	28
PID 2976 wrote to memory of 2264	2976	rundll32.exe	29
PID 2976 wrote to memory of 2264	2976	rundll32.exe	29
PID 2976 wrote to memory of 2264	2976	rundll32.exe	29
PID 2976 wrote to memory of 2264	2976	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 228
    3⤵
    - Program crash
    PID:2264