09f74ca0de08a2181671b49c9f399fdcfbcc8d21f08d216bbdbbb4501104f57a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 10:06

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

36bd5fe93cba28f56faa83b84833d33f
SHA1

f45d3207fb707c6a768cb5799fcc04da13503b79
SHA256

6da03a7b9dc18a940c910903c31b09934bfcac582aabbb2fe081e540098b1d54
SHA512

0dd06cb7d521980fca53bb4c3def3670b847291236dcf2c802b41b94c69e17e43cc16c8672b5af4f2c00d2732e3685e80171ca579cef9f0b44c4fee56caba58e
SSDEEP

192:T4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12hgszA:TysdM80dCI5a2LsQ5IlPNRY00AlAfU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	4584	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4584	3192	rundll32.exe	84
PID 3192 wrote to memory of 4584	3192	rundll32.exe	84
PID 3192 wrote to memory of 4584	3192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 624
    3⤵
    - Program crash
    PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4584 -ip 4584
1⤵
PID:3160