c55732168517ea7a91d294844d2e32da201bb31e95ec484f68f29fa5efb5e08b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 17:04

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

298KB
MD5

82f572276aff5f06f55240323ad8d267
SHA1

0eeef4b8aa4787a3912522187855c8c0743bbca5
SHA256

5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe
SHA512

b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b
SSDEEP

3072:rbOTuQTXP+y+sHKm3oNf7hp6rKBemO62GgGupRKQr/B8B6QWF+lOv6i7At4vSxrq:rbOaQ5pt0pZzru1V8BjWFS+pE5d8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2324	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2940 wrote to memory of 2324	2940	rundll32.exe	28
PID 2324 wrote to memory of 3028	2324	rundll32.exe	29
PID 2324 wrote to memory of 3028	2324	rundll32.exe	29
PID 2324 wrote to memory of 3028	2324	rundll32.exe	29
PID 2324 wrote to memory of 3028	2324	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 220
    3⤵
    - Program crash
    PID:3028