320645febddfa1e48254b172cadc4e3d4158386622f5c82c96f371b34c82c83e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 10:43

Target

$PLUGINSDIR/MyNsisExtend.dll
Size

1000KB
MD5

e742994a264d88033d595cbc09499f16
SHA1

7e86669bb75832cc37e26717f32b4132a6fd3c13
SHA256

64f931bada36929605ea37aba72e9d6de40a5b06ee6149394f709ce26eb1f10f
SHA512

0db617ed3b5ac6bd0ad03083ffdbfc0c001b0de10cbe0c9d66d6b5981388c6b1437356006cedc8d82970fa87ab2cddd5e78b489003e28364b2cbe9ceab797cef
SSDEEP

12288:YA9wacdH5SoF0y89fi94hhWEifqF5beC0YU6r2H5SFCZLW8fx0riOxT+5Sw:YA9EAfHhhWMr0Mr8ZLW8u33w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	1960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 2124 wrote to memory of 1960	2124	rundll32.exe	28
PID 1960 wrote to memory of 1236	1960	rundll32.exe	29
PID 1960 wrote to memory of 1236	1960	rundll32.exe	29
PID 1960 wrote to memory of 1236	1960	rundll32.exe	29
PID 1960 wrote to memory of 1236	1960	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MyNsisExtend.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MyNsisExtend.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 240
    3⤵
    - Program crash
    PID:1236