1210629ab21d852a0635a51367e9d58035aa9369b72e5db136e31bd26441394c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 09:51

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

573fb05d88cd616d1e5ffc0c4ccbabde
SHA1

3a2beccedf9b9e90b175dd52ebcce47bc4b11047
SHA256

d24967fa2fe242104db9043c4108dfbc240876dfa68c932ca81332a129e6348d
SHA512

822975def4dc7f46f5eb4067383491d09481a5359cd7d4361a465f55e7d37149c2fa9659031753a08d89b45340c451d20ba70e920a1f8e25c6e556e94ff95124
SSDEEP

1536:Gn+ep9yMt6Dl2wtJl2eeXcYy6uapfUqYLz0QNRLlzleWDJmi05QePP5/yfWFSMi:GTyUa2iWd+NDJmiQQ+hCWL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	1776	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1776	4496	rundll32.exe	82
PID 4496 wrote to memory of 1776	4496	rundll32.exe	82
PID 4496 wrote to memory of 1776	4496	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 600
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1776 -ip 1776
1⤵
PID:4704