6f33532ae4882ed5a6551b3a2df4b8a82b3395911884dfc43ea8420fd5f10ea9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 09:58

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

a5b84d250794433db5a2d26f34699dd9
SHA1

bc06abccf6a4783973ec11b6766b43b4a265820c
SHA256

96f3357a024c549d7cb9e6447b1a56a2a8029b4f12e6e597428e68620761c5e0
SHA512

121d67f85a24096799ed913dccb64ef65d9479f98a6d88c2a0e05f05a65f460d557c5fdfe2c42a0a61b9cbaedd9b7031978111a2713250a89848ab4f3bb4ce84
SSDEEP

192:/4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12FgszA:/ysdM80dCI5a2LsQ5IlPNRY00AlAbU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	1932	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1924 wrote to memory of 1932	1924	rundll32.exe	28
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29
PID 1932 wrote to memory of 2732	1932	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 224
    3⤵
    - Program crash
    PID:2732