350f2b7af2310de1eec502397eb73b1e5c909b989294a1e988911c07a8ec616c

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:40

Target

$PLUGINSDIR/nsis7z.dll
Size

167KB
MD5

692479f7c07a64a6a632148e382f0e22
SHA1

cd14982a8e048ae98860db52f042850b63f9f40f
SHA256

cb195d62df55a939e238063c13c792237501f2297386c11229b1558eea9ddfbb
SHA512

7ed81c13ea6d3b5fbed778ff0f2b3361399826296711ec7dc019432ecd79a72e7d6e78d5fab144600ec55b46a56c11ff99f0860855522750883d7693ca885809
SSDEEP

3072:shuC5kBdKlB5Rkg0rQHWjfxTKYaE51GiCySqEMRRQRkM8CQme+5xuPFK:Qq7WHIrLjfxdXREJ/8CgK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3092	1748	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1748	2848	rundll32.exe	82
PID 2848 wrote to memory of 1748	2848	rundll32.exe	82
PID 2848 wrote to memory of 1748	2848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 600
    3⤵
    - Program crash
    PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1748 -ip 1748
1⤵
PID:1532