c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 18:08

Target

$TEMP/NSISPromotionEx.dll
Size

1.8MB
MD5

9e76a9d52f45845280024561eb0583d2
SHA1

89a92563bfcb784ce0a17b3ba02e336f59dfb6b8
SHA256

c10670e98eda82fe0984a02c88949ac1be96ca466d6d424a77ea5b67118e8d4d
SHA512

9dab31a7dd32c01ca6d6ae38f38cfe8aa84a338b3cd4d540e308e246ec09f390a00bfc698a0b739951df66356a74de925b7e2c9be22c0e06ad2dd1b891451715
SSDEEP

24576:YnLxB35LZ4nY2BNc3oXrgJnNZdC/eTPakySNerBOS7bCWlti66p:cLxph+hC3JHOeTPakyfkS7bHlti9p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	1752	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1284 wrote to memory of 1752	1284	rundll32.exe	28
PID 1752 wrote to memory of 2668	1752	rundll32.exe	29
PID 1752 wrote to memory of 2668	1752	rundll32.exe	29
PID 1752 wrote to memory of 2668	1752	rundll32.exe	29
PID 1752 wrote to memory of 2668	1752	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\NSISPromotionEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\NSISPromotionEx.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 252
    3⤵
    - Program crash
    PID:2668