d24d1726864be6bf4458f9c23ab89c03506bbb7d662cb68c27dff4c97e560e91

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:13

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

97KB
MD5

86991f180010ceafd3d79fcbcbbf793d
SHA1

36078ae4127cac5f4e850a2d081424a0f5e1c679
SHA256

e50922c5f9c5c077f1f526b35bce86d326d0ee9da64563fc3b6316097b4d95e9
SHA512

2e711fd3b0196eda085876d5d05192ee15ba20677d6e1f6ea74cd8a7e8166d8cf4ff52682d92635eb560d7eb84a56a71ad26326a09118e8709f1600d2bc89782
SSDEEP

1536:UY9Fs5msanhmlskC4eW2EdPznZqk/g6dzglSpt9jafCj:UY9F4mKlO4eW2E1Hg6dzglS9GE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	3004	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 2160 wrote to memory of 3004	2160	rundll32.exe	28
PID 3004 wrote to memory of 2292	3004	rundll32.exe	29
PID 3004 wrote to memory of 2292	3004	rundll32.exe	29
PID 3004 wrote to memory of 2292	3004	rundll32.exe	29
PID 3004 wrote to memory of 2292	3004	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 224
    3⤵
    - Program crash
    PID:2292