736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:10

Target
$PLUGINSDIR/nsProcess.dll
Size 4KB
Sample240214-clyhcsfe95
SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
MD5 8f4ac52cb2f7143f29f114add12452ad
SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2304	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 1948 wrote to memory of 2304	1948	rundll32.exe	28
PID 2304 wrote to memory of 2456	2304	rundll32.exe	29
PID 2304 wrote to memory of 2456	2304	rundll32.exe	29
PID 2304 wrote to memory of 2456	2304	rundll32.exe	29
PID 2304 wrote to memory of 2456	2304	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 228
    3⤵
    - Program crash
    PID:2456