c55732168517ea7a91d294844d2e32da201bb31e95ec484f68f29fa5efb5e08b

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 17:04

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

298KB
MD5

82f572276aff5f06f55240323ad8d267
SHA1

0eeef4b8aa4787a3912522187855c8c0743bbca5
SHA256

5f901e526effe89e783eb4acfdec0f485a465a98b9069d0b13ffd5e2ed73adfe
SHA512

b29a1faa150dbe70b2cffccb233d25548c812a2f773e031b76d9de314bc33ad4dad69b821f315535dc0afdcf0e6e5749d6487ff9eecac927999b93906ec15c0b
SSDEEP

3072:rbOTuQTXP+y+sHKm3oNf7hp6rKBemO62GgGupRKQr/B8B6QWF+lOv6i7At4vSxrq:rbOaQ5pt0pZzru1V8BjWFS+pE5d8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	3412	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3412	2808	rundll32.exe	82
PID 2808 wrote to memory of 3412	2808	rundll32.exe	82
PID 2808 wrote to memory of 3412	2808	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  PID:3412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 628
    3⤵
    - Program crash
    PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3412 -ip 3412
1⤵
PID:4844