6c515bb4667f0f7ff2777a4c25d70ceb7b3677b652644a26565afcd939a43efc

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 20:13

Target

$PLUGINSDIR/downloader_nsis_plugin.dll
Size

1.2MB
MD5

5ea2e04035e9c615e3666a3f7505b537
SHA1

e1679f203e4d03bc72915be0ae09397393f4e045
SHA256

bddab1b50045f86f3cc5fd2035eb7f64baae26f3ff69b03ccdbfc12a568bec19
SHA512

a88cff452023ebb49ee677c11fbcb1753933ae02b89b26fe7e881bc13af0790bfdae949f176e0ed405d95c27f6564d6050f4265cb498bf2305fa841ac71a6c1d
SSDEEP

24576:BYApG+/ZY0KkuRGTpZ9tNt6nq7qQQ+uoDaJf0XbAec:ZpGUZDKvGTfbNt6nq7qQ1DaJf0XbAec

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	400	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 1260 wrote to memory of 400	1260	rundll32.exe	28
PID 400 wrote to memory of 2844	400	rundll32.exe	29
PID 400 wrote to memory of 2844	400	rundll32.exe	29
PID 400 wrote to memory of 2844	400	rundll32.exe	29
PID 400 wrote to memory of 2844	400	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\downloader_nsis_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\downloader_nsis_plugin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 284
    3⤵
    - Program crash
    PID:2844