c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 18:08

Target

$TEMP/NSISTrigger.dll
Size

97KB
MD5

4a8178519a84a5aefd06c9c720360c69
SHA1

d3598a9dee27879889b7ba3f3abe218586f11917
SHA256

fdd180c2c1006d1538bae0e968d24ae70f7386f30b42e13e9cf45a48d1b0bbc0
SHA512

967579323f7286fd3fa4f3c7f259ed9fccb63a8aa6fd2647fb8e2725c4d968b2fe2746a517078866393143d85c352e29a160b04a594f1b950d8918fa530655c8
SSDEEP

1536:Yu57R+hRzZNzqwTL7laO4Qim8A1DwLkGqQcNasWjcd+B4Vc:Yu5+BnfL7jpKAGq1+B4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	1660	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1660 wrote to memory of 2916	1660	rundll32.exe	29
PID 1660 wrote to memory of 2916	1660	rundll32.exe	29
PID 1660 wrote to memory of 2916	1660	rundll32.exe	29
PID 1660 wrote to memory of 2916	1660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\NSISTrigger.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\NSISTrigger.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 628
    3⤵
    - Program crash
    PID:2916