14ed6b4a7728e35d16196ce7cc2d4e81c78e3cfe0d41cfc25276b90a5c2135a9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 11:18

Target

$PLUGINSDIR/NSISEncrypt.dll
Size

129KB
MD5

806e34ff92b29f84122151787c0ddc2b
SHA1

a37a6862c4bcf0d3bd1595ced0a8df64cfb60eac
SHA256

79ecc32866fac9e7547057643dedfa605147c5dc5c5479c9d75c850c7a6e95fc
SHA512

7ebe5755b52b3dec6a155ffe0064be0cd72a6e7088d0e1b7bf1bde9fe5f3c2c7e61b6eb696fb4abd26d312f91f8bdaffff6e001907d736fd863073b1bdd086d4
SSDEEP

1536:pn+ep9yMt6Dl2wtJl2eeXcYy6uapfUqYLz0QNRLlzleWDJmi05QePP5/yfrFSMi:pTyUa2iWd+NDJmiQQ+hCrL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	1936	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 2004 wrote to memory of 1936	2004	rundll32.exe	28
PID 1936 wrote to memory of 2960	1936	rundll32.exe	29
PID 1936 wrote to memory of 2960	1936	rundll32.exe	29
PID 1936 wrote to memory of 2960	1936	rundll32.exe	29
PID 1936 wrote to memory of 2960	1936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISEncrypt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 220
    3⤵
    - Program crash
    PID:2960