d1f9d8e109467ecb01945dea8dbb7ff17c7f8494dde58528ef21925b1de90697

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:59

Target
$PLUGINSDIR/nsis7z.dll
Size 391KB
Sample240614-ces93avdpn
SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
MD5 c6a070b3e68b292bb0efc9b26e85e9cc
SHA1 5a922b96eda6595a68fd0a9051236162ff2e2ada
SHA512 8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8
SSDEEP 6144:KI4T3K6gRPI8G1W3ODli+GIuuu8M1CkJagSdJFCAvgw7nv0Yy6ptK:KBK6gU1YsI+GIuEbgagS7FCyp7cD6po
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	4532	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4532	4488	rundll32.exe	80
PID 4488 wrote to memory of 4532	4488	rundll32.exe	80
PID 4488 wrote to memory of 4532	4488	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 624
    3⤵
    - Program crash
    PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4532 -ip 4532
1⤵
PID:2632