1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:39

Target
$PLUGINSDIR/nsis7z.dll
Size 171KB
Sample240529-mqe7pace72
SHA256 ce6fc1b521e64ea89f4532cbd74f06f85d21018ac5196b4f8169627926e40971
MD5 a26d3887a69ea3e03c1cc4367494e080
SHA1 e25b63467aadc27b2ee7daa93ea886c01f90025e
SHA512 97e0343b5c1a478f886132d0a41737e41499485451fe2fa74fa3898ddbb15013ec424a84ecc19426d59e9b9870e283735d29ccba1d73d448e0f3ae320a741a7c
SSDEEP 3072:vOyXSMpGO+JNP7FyE8R2TX/u5IiNNKdTmTfL5sY03tzZaq5bXi:rXSe76tByH87/aIiWdT6fL56tME
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1360	4864	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4864	4052	rundll32.exe	82
PID 4052 wrote to memory of 4864	4052	rundll32.exe	82
PID 4052 wrote to memory of 4864	4052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 600
    3⤵
    - Program crash
    PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4864 -ip 4864
1⤵
PID:1392