acd66a2ecfabdfc6e08b3cdfcea33f373530eb2f7d2de5d425a267eaa8d80305

Analysis

max time kernel
32s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 14:30

Target

$PLUGINSDIR/NSISPlugin.dll
Size

804KB
MD5

e82844a8ec4393e7019ce569d02c297c
SHA1

1c1c456ec8817ed9fe5397307f803d5b31ba9380
SHA256

79d42e1c16ce176daa4a90b9f8aac4952fb93d8b76b4f60174aeb92fa45c4754
SHA512

5d1ceb4b42794b2561bcde6ebf9d6e4b7e7eb94ca00529a9e1321de6f839737e9368750d417cc541fae6b6397d92cb906a6d4e56cb32226fc7adee8c645e39aa
SSDEEP

12288:4ogD1EKG3VBf8gtQ/SuPvs5q+yct5xhTh5sltTjJIPgAow2Oq:4ogD2KG3VBUgtoSIwnXgltT1nAow2Oq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	2040	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2040	3480	rundll32.exe	82
PID 3480 wrote to memory of 2040	3480	rundll32.exe	82
PID 3480 wrote to memory of 2040	3480	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#1
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 644
    3⤵
    - Program crash
    PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2040 -ip 2040
1⤵
PID:1640