97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 02:29

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

131KB
MD5

7aff208a344394104f171d8e7d5f0a47
SHA1

2a4366b88365f93a281b9288de040fa84e3d0c78
SHA256

d7b3aaad152cc2f782fec2ed2b9f123ce7a624551f7f3e3aac9384bf6d123b58
SHA512

0398b91d2be430d03be0b622ac19c5153c9bbbb74127fe1a20f4424d02d031ad574cb56c5c7ce8b93ac0b9ec70638be7a36e9d364a5732c47743c0b392f4d26a
SSDEEP

1536:XcUsV87Fox3kbAxTuOaK7xXH/PulnwPXQ9vCgzxQaNmLLmA5PBUyVc:M5G7uqbAf0cYCaNmL/5pUy6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	1816	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 2060 wrote to memory of 1816	2060	rundll32.exe	28
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29
PID 1816 wrote to memory of 2100	1816	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 224
    3⤵
    - Program crash
    PID:2100