9227a139da1fb0755d0cf08d242726bc56633753897948b732878e58db15d6ca

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 06:37

Target

$PLUGINSDIR/nsUnzip.dll
Size

146KB
MD5

77a26c23948070dc012bba65e7f390aa
SHA1

7e112775770f9b3b24e2a238b5f7c66f8802e5d8
SHA256

4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43
SHA512

2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065
SSDEEP

3072:3imoHcJg67rm+2X7jiYwJAmcxaw2VvnCNizd9XER4I6CAZJPtAY3:3I8Jlrm7SnjCNizdhER4I3kP3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2156 2136 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2156	2136	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 1872 wrote to memory of 2136	1872	rundll32.exe	rundll32.exe
PID 2136 wrote to memory of 2156	2136	rundll32.exe	WerFault.exe
PID 2136 wrote to memory of 2156	2136	rundll32.exe	WerFault.exe
PID 2136 wrote to memory of 2156	2136	rundll32.exe	WerFault.exe
PID 2136 wrote to memory of 2156	2136	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsUnzip.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224
    3⤵
    - Program crash
    PID:2156