f92ad1e92780a039397fd62d04affe97f1a65d04e7a41c9b5da6dd3fd265967e

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240215-es
resource tags

arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows
submitted
20/02/2024, 17:24

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

0a6f707fa22c3f3e5d1abb54b0894ad6
SHA1

610cb2c3623199d0d7461fc775297e23cef88c4e
SHA256

370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
SHA512

af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8
SSDEEP

96:e97GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN0u3e:eBXhHR0aTQN4gRHdMqJVgN0N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2552	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 1544 wrote to memory of 2552	1544	rundll32.exe	28
PID 2552 wrote to memory of 2908	2552	rundll32.exe	29
PID 2552 wrote to memory of 2908	2552	rundll32.exe	29
PID 2552 wrote to memory of 2908	2552	rundll32.exe	29
PID 2552 wrote to memory of 2908	2552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 224
    3⤵
    - Program crash
    PID:2908