27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:47

Target

$PLUGINSDIR/nsisSlideshow.dll
Size

7KB
MD5

92148c2fcdc2c588aebc6acaef11ad4d
SHA1

5df90a446d80ad69816c2375e01287ba1c3fef96
SHA256

3beaaf45b95d7554e646812291025b873b1265ef63723aefe6ffeeac40469231
SHA512

a10951980148ff999a7a279cdb041c5a158be9f5a8abee22b51fae4cd8eeb84707724f7d4383eed0e90267bf299a9f041bb659aae624a9cf7cb97a58bf996924
SSDEEP

96:jxDCYdyPLISNJikdpdlCE5tJeCZiPodd:t8kkdD0OCLPodd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1584	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisSlideshow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisSlideshow.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 224
    3⤵
    - Program crash
    PID:2188