16e63b02ecab333d53a5db8a61afcc2e7baf17f22f1e905683bc4d4350f24986

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 14:04

Target

$PLUGINSDIR/nsisXML.dll
Size

68KB
MD5

98acfacfe6ce2c368b5fc374ebd16f17
SHA1

db3716992b9510240940984ac6487980d5f936ab
SHA256

eadad51e7b23700ff6614979735588c949daf91aece01cb2c5a01692d7a69ec7
SHA512

86f5f74f05961a09b4dab7359ef1367045f50b21b8323b1e72de6c99454f8a209f69f747791b6c8c192fcfde6781516b072457df22ebf8c1a2553b697cdb25eb
SSDEEP

768:ZB6quSzdYxM0QUvhOV5QTq7vsN2JhIDrWkQro7yL2Fg7AlHIyB:ZBRuSzdCkuOoTq7EY/ImU7OUllo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	1948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 2340 wrote to memory of 1948	2340	rundll32.exe	28
PID 1948 wrote to memory of 2332	1948	rundll32.exe	29
PID 1948 wrote to memory of 2332	1948	rundll32.exe	29
PID 1948 wrote to memory of 2332	1948	rundll32.exe	29
PID 1948 wrote to memory of 2332	1948	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisXML.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisXML.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 224
    3⤵
    - Program crash
    PID:2332