12f2835ca32bd0bdd31acdd143176fe863ec9972a8f0fafd0e8b4a5203789592

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 14:51 UTC

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

1010e36186a8ccadb0ac010269af2f80
SHA1

1fb09d81db09c8620cb8982c3083287055fa265d
SHA256

6e3abd225c7b454bebd7a74fa4435704210b489b29161fe9bb66b1ff4343ece3
SHA512

a45e41484b41db245efc55a2751126a0342f3fff792a5d5d5592da448f12b5053691374377bf7b81a3950bdad59c264168b20ae88252e00b9a996624f02d66ec
SSDEEP

1536:Nn+ep9yMt6Dl2wtJl2eeXcYy6uapfUqYLz0QNRLlzleWDJmi05QePP5/yfQFSMi:NTyUa2iWd+NDJmiQQ+hCQL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	1984	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1984 wrote to memory of 2680	1984	rundll32.exe	29
PID 1984 wrote to memory of 2680	1984	rundll32.exe	29
PID 1984 wrote to memory of 2680	1984	rundll32.exe	29
PID 1984 wrote to memory of 2680	1984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 220
    3⤵
    - Program crash
    PID:2680