68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 16:35

Target

$PLUGINSDIR/npeNSISUtil.dll
Size

289KB
MD5

e207be5269902adf36bb328174b41985
SHA1

b2db8406290b7d89320e660e9b07c3de444cdede
SHA256

c60d65fbfab309f8dbbbdef8735f52e77166394ed919302f537f4406073428fd
SHA512

359f9741f62294b175d2261e34b581a522b59dc4b28470d2dc7351ce16af54f02a5069eca2b9f15f4f79c3fcdf3f3fff9231cbaa00eb935a1ebc6d10bbe2c151
SSDEEP

3072:fScXRqUMRrNsD29MXew44JYjIU3rKixkJO/pjaS7odPrBxUBnhfxf2uKfsbGuJgn:f83Mm4IaxOhwuKnuJgS6IUxXY+jKat

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2380	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2376 wrote to memory of 2380	2376	rundll32.exe	28
PID 2380 wrote to memory of 2248	2380	rundll32.exe	29
PID 2380 wrote to memory of 2248	2380	rundll32.exe	29
PID 2380 wrote to memory of 2248	2380	rundll32.exe	29
PID 2380 wrote to memory of 2248	2380	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\npeNSISUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\npeNSISUtil.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 248
    3⤵
    - Program crash
    PID:2248

memory/2380-0-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2380-1-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2380-3-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2380-2-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2380-4-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download