6f33532ae4882ed5a6551b3a2df4b8a82b3395911884dfc43ea8420fd5f10ea9

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 09:58

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

a5b84d250794433db5a2d26f34699dd9
SHA1

bc06abccf6a4783973ec11b6766b43b4a265820c
SHA256

96f3357a024c549d7cb9e6447b1a56a2a8029b4f12e6e597428e68620761c5e0
SHA512

121d67f85a24096799ed913dccb64ef65d9479f98a6d88c2a0e05f05a65f460d557c5fdfe2c42a0a61b9cbaedd9b7031978111a2713250a89848ab4f3bb4ce84
SSDEEP

192:/4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12FgszA:/ysdM80dCI5a2LsQ5IlPNRY00AlAbU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3756	1496	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1496	1492	rundll32.exe	81
PID 1492 wrote to memory of 1496	1492	rundll32.exe	81
PID 1492 wrote to memory of 1496	1492	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 624
    3⤵
    - Program crash
    PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1496 -ip 1496
1⤵
PID:1696