12f2835ca32bd0bdd31acdd143176fe863ec9972a8f0fafd0e8b4a5203789592

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 14:51

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

1010e36186a8ccadb0ac010269af2f80
SHA1

1fb09d81db09c8620cb8982c3083287055fa265d
SHA256

6e3abd225c7b454bebd7a74fa4435704210b489b29161fe9bb66b1ff4343ece3
SHA512

a45e41484b41db245efc55a2751126a0342f3fff792a5d5d5592da448f12b5053691374377bf7b81a3950bdad59c264168b20ae88252e00b9a996624f02d66ec
SSDEEP

1536:Nn+ep9yMt6Dl2wtJl2eeXcYy6uapfUqYLz0QNRLlzleWDJmi05QePP5/yfQFSMi:NTyUa2iWd+NDJmiQQ+hCQL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	3972	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3972	4092	rundll32.exe	85
PID 4092 wrote to memory of 3972	4092	rundll32.exe	85
PID 4092 wrote to memory of 3972	4092	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  PID:3972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 600
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3972 -ip 3972
1⤵
PID:448