c55732168517ea7a91d294844d2e32da201bb31e95ec484f68f29fa5efb5e08b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 17:04

Target

$PLUGINSDIR/NSISArray.dll
Size

32KB
MD5

8b43a3f284632edfbb51665b2e0b8a3c
SHA1

af6ab111856be7af7212a82b052e8b5656159b35
SHA256

336e588999bf6b1cd6c894dbf5a73b2198d48c935f8b1251687845cce467dc67
SHA512

3a9add285d074db534937b193b92f8e0503c94c97b11f0abe5d9358342fbc57461ba1f559fa19e0522cfec914b8a007f11bec34abef17faaca5de8bda0dbaf94
SSDEEP

768:uCyg1AT+KRSHKrHrkJg81qdJd18atH18Hup23+zj+:WgcwHgn8Uh8an8t0+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2132	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 2132 wrote to memory of 2188	2132	rundll32.exe	29
PID 2132 wrote to memory of 2188	2132	rundll32.exe	29
PID 2132 wrote to memory of 2188	2132	rundll32.exe	29
PID 2132 wrote to memory of 2188	2132	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISArray.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISArray.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 224
    3⤵
    - Program crash
    PID:2188