bc4101cb2be2bc8fedb16c82b4c4dc808176f519f9c2c8012c6e18b4b35d932d

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 07:54

Target

$PLUGINSDIR/NSIS_HTTPRequest.dll
Size

55KB
MD5

52033e4f012b5ea9e6a2a719c5a9f2bf
SHA1

14ae0a9600997b77057a6c07bdf0ad974971fc01
SHA256

00b7b5c1addeb7404089cb44743701614717723397790a73a48118aecbc423b4
SHA512

d3101723c485a28d1871ca49656b19681a36cee459d061ba8a66a97ead9e5d87d635bee912ebbcd5d743f1d562d4dbe0952d97987b7016fd0a6f54dacbc95f45
SSDEEP

768:fRkeem9aVIuOdDSzL3cMSWVEDaoWX6P+QL3H6WesAAZz6Fi5RvJt:fHemOIuOQ/ZtEpW6TWAZJ5Rv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1320	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1320	2788	rundll32.exe	91
PID 2788 wrote to memory of 1320	2788	rundll32.exe	91
PID 2788 wrote to memory of 1320	2788	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSIS_HTTPRequest.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSIS_HTTPRequest.dll,#1
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 608
    3⤵
    - Program crash
    PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1320 -ip 1320
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3624