1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:39

Target
$PLUGINSDIR/nsis7z.dll
Size 171KB
Sample240529-mqe7pace72
SHA256 ce6fc1b521e64ea89f4532cbd74f06f85d21018ac5196b4f8169627926e40971
MD5 a26d3887a69ea3e03c1cc4367494e080
SHA1 e25b63467aadc27b2ee7daa93ea886c01f90025e
SHA512 97e0343b5c1a478f886132d0a41737e41499485451fe2fa74fa3898ddbb15013ec424a84ecc19426d59e9b9870e283735d29ccba1d73d448e0f3ae320a741a7c
SSDEEP 3072:vOyXSMpGO+JNP7FyE8R2TX/u5IiNNKdTmTfL5sY03tzZaq5bXi:rXSe76tByH87/aIiWdT6fL56tME
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	2204	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2084 wrote to memory of 2204	2084	rundll32.exe	28
PID 2204 wrote to memory of 1860	2204	rundll32.exe	29
PID 2204 wrote to memory of 1860	2204	rundll32.exe	29
PID 2204 wrote to memory of 1860	2204	rundll32.exe	29
PID 2204 wrote to memory of 1860	2204	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 224
    3⤵
    - Program crash
    PID:1860