c9cf241b510622abc59c2c15a217a7dab5467c09548e3b24401ae202401a69bb

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 13:54

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

128KB
MD5

9bb7eeaf65c2a6367956374c6105bea7
SHA1

530b83c65939abcec7b1ed17ee13d8e169ad9e34
SHA256

5ac5cd24d0dc531ca1113c62209575e25f6dbb3c3734e8cc1f7c5237a3c94b52
SHA512

b3221cc2f3217482e0de772c496a1adcd7966a81f670b8400d4bde5fb69026fa76e5f71793070ce1143c81d44eddc83fffaa00ba5ea27c3d5aa854e6de476d06
SSDEEP

1536:FrsTtUNS1rRfGZ7x2/tzP2yNbslfwIEN61gkEKZuEVnSA5m63:F+tKS1lG/2VcFg6ErEVn/5P3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	1420	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1420	4120	rundll32.exe	82
PID 4120 wrote to memory of 1420	4120	rundll32.exe	82
PID 4120 wrote to memory of 1420	4120	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 612
    3⤵
    - Program crash
    PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
1⤵
PID:848