3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:19

Target

$PLUGINSDIR/BcNsisHelper.dll
Size

760KB
MD5

e0046b158c4a1c1a6970a64c5e4d9ea4
SHA1

3ce0e866dcbcf30d4e787423c4235f09a6463a24
SHA256

8cce6e8ece1881744e4474f03c2764f8058bb2718f20b3dfad8fb6cbd668f12d
SHA512

716f63be8f238574d47ca0a91a78d8c5708537c90be1fce385c8fb754fd6fe33e91fe0ac7b0ef72fd3b7c6b11d310b3ac642a0351b4392f363c47e6b3ec6eff3
SSDEEP

12288:5q3UoTuNKNPwEkXOhkRca7VFWwrX4CmbgfQmv/Jfh/hqhjhjhghMQM:hYPwX1Kq3T4CmSQyQz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2748	3028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BcNsisHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BcNsisHelper.dll,#1
2⤵
PID:2748