f23044e2fd0574d7ec3d9e4674f916e0345088fa0d4ba7987d39284e3b858454

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 09:09

Target

$PLUGINSDIR/nsDui.dll
Size

5.8MB
MD5

cc7a39474889f5c2f7a356ffdc379e84
SHA1

70ed8bb13800c0caa9428ad27da34dbf817b7102
SHA256

ce70c1e7ebd8d0faf8691a9d585c8947528d390bf1d847dff79f5aae5c0e0f09
SHA512

3ec15aa68d0c45c8a22a5b9366a210ae8031ee7b7543c66b3226c716cc8317a898bae0cb9ac01e162a2db6979cd7fc63fdc3008e8a00819f84f7a6a2e75074df
SSDEEP

98304:TqD/IiTz+xbDcc0Wc9dOJxYKmSAWjOcsyxKwOj0jRHKmSAW0OW4JXlVgFKzpxdB9:TYLOxhg9dOJBFFOjwOj3FmOXPV5prBB7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	1116	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1916 wrote to memory of 1116	1916	rundll32.exe	28
PID 1116 wrote to memory of 2300	1116	rundll32.exe	29
PID 1116 wrote to memory of 2300	1116	rundll32.exe	29
PID 1116 wrote to memory of 2300	1116	rundll32.exe	29
PID 1116 wrote to memory of 2300	1116	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDui.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 252
    3⤵
    - Program crash
    PID:2300