22987c398c668599e79f7f89a3d6b92a9c9f2d9dec98cbbea2e1ab5e6d3edbff

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 11:34

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

f74ab11bda41d22bd80224643e04b5f9
SHA1

ea7a67987074ff6478d230d3d77253ee6d4bf230
SHA256

7fce1d6bb1c59f47a789468a382a3461fe257b0579c8f91a8a666eb728f9c03b
SHA512

251a158c189497def370a9a519a59264e15dee09890bc0806e1e7e1b9246255be17727e683eb95228be6143bfae1ee70f8d500b4df623d202427e99b8a6dc6c9
SSDEEP

1536:Iy5ZZpmn2orlR1mM+g5P6gP6uvpPbxYezUANRL1zaeuDJmi35QAhrsXvfDbFaob:IyanH9GrE17cDJmiJQ8q3Dko

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	2096	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 492 wrote to memory of 2096	492	rundll32.exe	29
PID 2096 wrote to memory of 2240	2096	rundll32.exe	30
PID 2096 wrote to memory of 2240	2096	rundll32.exe	30
PID 2096 wrote to memory of 2240	2096	rundll32.exe	30
PID 2096 wrote to memory of 2240	2096	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 220
    3⤵
    - Program crash
    PID:2240