12978eef9daed92259dc10c461bdf027cc646b49425f9941da73d4ded1483d86

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 20:18

Target

$PLUGINSDIR/AnvsoftNsisPlugin.dll
Size

390KB
MD5

8634cbd6325144713eaedf50cb61c76c
SHA1

e755cafbf63d9066f8333b83764dd844fe9dc741
SHA256

db7d131aff0761e95d94c77b723295c517daab0dcd86e40981b91ca759826e19
SHA512

0555f3b423a5da9b1eec429e1d6312d08d09c9ad559a570c212120bfe40187b52d9db528a30e76aa89e0dd43dfa828d63861d1248041595e19357f27814b00b4
SSDEEP

6144:lCkOWBnAuL504BcIDbUfJDRZPy+ojMO5SqoSBnP1snP/Nb62akk:lF1jeDRZPyzMO0SnP1snw2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnvsoftNsisPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnvsoftNsisPlugin.dll,#1
  2⤵
  PID:2996