0cc54e69016e3d5a80e229c768ac37a02aea3a973a5447593c0132281e383942

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 14:16

Target

$PLUGINSDIR/nsExec.dll
Size

9KB
MD5

4e7650968ebe9fd65414dff1e18241ac
SHA1

a5dcbea4fba7edc6f43485a9e66faa2bab13ee1b
SHA256

339581eec7e0bb98add22f78dac788db517da599d1a9b598cff3226b886d50da
SHA512

39e905365a8b58460c54443ca96e9f6a5ae392108d93421e55fdb382858e9e2e389952ffd50fae74f200942962f45b742815e108a74d657af9747d05e516d796
SSDEEP

96:Y/h/HwDMq2wUlAYx/g1w8NxZ4t0DNSPSoVJNgI9KjRTUTWFdr2t9XgrzgtljBb3l:Ch/Qj2pl/Z85DSPvHK1nSF53ig1V8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3712 1412 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3712	1412	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4964 wrote to memory of 1412	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 1412	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 1412	4964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
2⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 612
3⤵
- Program crash
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1412 -ip 1412
1⤵
PID:4020

memory/1412-0-0x0000000074950000-0x0000000074958000-memory.dmp

Filesize
32KB

Download