c20450bd488bd5980bcb9f2a0d402d2a5deabe51b0fb5cf31cf86b084b2a1997

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 11:32

Target

$PLUGINSDIR/nsis7z.dll
Size

167KB
MD5

692479f7c07a64a6a632148e382f0e22
SHA1

cd14982a8e048ae98860db52f042850b63f9f40f
SHA256

cb195d62df55a939e238063c13c792237501f2297386c11229b1558eea9ddfbb
SHA512

7ed81c13ea6d3b5fbed778ff0f2b3361399826296711ec7dc019432ecd79a72e7d6e78d5fab144600ec55b46a56c11ff99f0860855522750883d7693ca885809
SSDEEP

3072:shuC5kBdKlB5Rkg0rQHWjfxTKYaE51GiCySqEMRRQRkM8CQme+5xuPFK:Qq7WHIrLjfxdXREJ/8CgK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4876	4576	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4576	3880	rundll32.exe	83
PID 3880 wrote to memory of 4576	3880	rundll32.exe	83
PID 3880 wrote to memory of 4576	3880	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsis7z.dll,#1
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 600
    3⤵
    - Program crash
    PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4576 -ip 4576
1⤵
PID:4532