b451c37d731da1f865a6aba1a217b3a16b07a13ecff9c40dcc759f372f4640bb

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 07:00

Target

$PLUGINSDIR/NSISPlugin.dll
Size

804KB
MD5

e82844a8ec4393e7019ce569d02c297c
SHA1

1c1c456ec8817ed9fe5397307f803d5b31ba9380
SHA256

79d42e1c16ce176daa4a90b9f8aac4952fb93d8b76b4f60174aeb92fa45c4754
SHA512

5d1ceb4b42794b2561bcde6ebf9d6e4b7e7eb94ca00529a9e1321de6f839737e9368750d417cc541fae6b6397d92cb906a6d4e56cb32226fc7adee8c645e39aa
SSDEEP

12288:4ogD1EKG3VBf8gtQ/SuPvs5q+yct5xhTh5sltTjJIPgAow2Oq:4ogD2KG3VBUgtoSIwnXgltT1nAow2Oq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	1604	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1604	4544	rundll32.exe	91
PID 4544 wrote to memory of 1604	4544	rundll32.exe	91
PID 4544 wrote to memory of 1604	4544	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 644
    3⤵
    - Program crash
    PID:564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1604 -ip 1604
1⤵
PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3980