967c299dbd33fa2bb6f9cda2d9a0a18174caf7011095791c099a7913c1190bcf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:56

Target

$PLUGINSDIR/NSISPlugin.dll
Size

804KB
MD5

e82844a8ec4393e7019ce569d02c297c
SHA1

1c1c456ec8817ed9fe5397307f803d5b31ba9380
SHA256

79d42e1c16ce176daa4a90b9f8aac4952fb93d8b76b4f60174aeb92fa45c4754
SHA512

5d1ceb4b42794b2561bcde6ebf9d6e4b7e7eb94ca00529a9e1321de6f839737e9368750d417cc541fae6b6397d92cb906a6d4e56cb32226fc7adee8c645e39aa
SSDEEP

12288:4ogD1EKG3VBf8gtQ/SuPvs5q+yct5xhTh5sltTjJIPgAow2Oq:4ogD2KG3VBUgtoSIwnXgltT1nAow2Oq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2912 2872 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2912	2872	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 2872	2860	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2912	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2912	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2912	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2912	2872	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 244
    3⤵
    - Program crash
    PID:2912