3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:19

Target

$PLUGINSDIR/BcNsisHelper.dll
Size

760KB
MD5

e0046b158c4a1c1a6970a64c5e4d9ea4
SHA1

3ce0e866dcbcf30d4e787423c4235f09a6463a24
SHA256

8cce6e8ece1881744e4474f03c2764f8058bb2718f20b3dfad8fb6cbd668f12d
SHA512

716f63be8f238574d47ca0a91a78d8c5708537c90be1fce385c8fb754fd6fe33e91fe0ac7b0ef72fd3b7c6b11d310b3ac642a0351b4392f363c47e6b3ec6eff3
SSDEEP

12288:5q3UoTuNKNPwEkXOhkRca7VFWwrX4CmbgfQmv/Jfh/hqhjhjhghMQM:hYPwX1Kq3T4CmSQyQz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4692 1668 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4692	1668	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3896 wrote to memory of 1668	3896	rundll32.exe	rundll32.exe
PID 3896 wrote to memory of 1668	3896	rundll32.exe	rundll32.exe
PID 3896 wrote to memory of 1668	3896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BcNsisHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BcNsisHelper.dll,#1
2⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 656
3⤵
- Program crash
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1668 -ip 1668
1⤵
PID:3652