16e63b02ecab333d53a5db8a61afcc2e7baf17f22f1e905683bc4d4350f24986

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 14:04

Target

$PLUGINSDIR/nsisXML.dll
Size

68KB
MD5

98acfacfe6ce2c368b5fc374ebd16f17
SHA1

db3716992b9510240940984ac6487980d5f936ab
SHA256

eadad51e7b23700ff6614979735588c949daf91aece01cb2c5a01692d7a69ec7
SHA512

86f5f74f05961a09b4dab7359ef1367045f50b21b8323b1e72de6c99454f8a209f69f747791b6c8c192fcfde6781516b072457df22ebf8c1a2553b697cdb25eb
SSDEEP

768:ZB6quSzdYxM0QUvhOV5QTq7vsN2JhIDrWkQro7yL2Fg7AlHIyB:ZBRuSzdCkuOoTq7EY/ImU7OUllo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	1188	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1188	4108	rundll32.exe	81
PID 4108 wrote to memory of 1188	4108	rundll32.exe	81
PID 4108 wrote to memory of 1188	4108	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisXML.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisXML.dll,#1
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 612
    3⤵
    - Program crash
    PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 1188
1⤵
PID:4912