d98fa9063e98716f5080aaad579ae15997c6a604086ff642d1a4d1499ec9eee1

Analysis

max time kernel
11s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 05:41

Target

$PLUGINSDIR/NSISdl.dll
Size

14KB
MD5

9c90c746adae5171c52b932080113331
SHA1

2eb66e61ad38a33aa6e6c245e84e0a78dfcc5460
SHA256

5b7be83ff4f023eba8d2d7ab972b067a904adc71f56a50cb367619cd116d0e92
SHA512

fca06b4b39fdd76002487a4f9a454bec5507b2355a0e4e2dfe044e2def52bbd01aa5d2a0077703f7b8814b248743fac2b84fd37f611e04281f7e5c428e245565
SSDEEP

192:wZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp/12VgsfA:wBo/680dCI5adOjFOg9//p27lAro

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
916	2552	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2120 wrote to memory of 2552	2120	rundll32.exe	29
PID 2552 wrote to memory of 916	2552	rundll32.exe	30
PID 2552 wrote to memory of 916	2552	rundll32.exe	30
PID 2552 wrote to memory of 916	2552	rundll32.exe	30
PID 2552 wrote to memory of 916	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 228
    3⤵
    - Program crash
    PID:916