0cc54e69016e3d5a80e229c768ac37a02aea3a973a5447593c0132281e383942

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 14:16

Target

$PLUGINSDIR/nsExec.dll
Size

9KB
MD5

4e7650968ebe9fd65414dff1e18241ac
SHA1

a5dcbea4fba7edc6f43485a9e66faa2bab13ee1b
SHA256

339581eec7e0bb98add22f78dac788db517da599d1a9b598cff3226b886d50da
SHA512

39e905365a8b58460c54443ca96e9f6a5ae392108d93421e55fdb382858e9e2e389952ffd50fae74f200942962f45b742815e108a74d657af9747d05e516d796
SSDEEP

96:Y/h/HwDMq2wUlAYx/g1w8NxZ4t0DNSPSoVJNgI9KjRTUTWFdr2t9XgrzgtljBb3l:Ch/Qj2pl/Z85DSPvHK1nSF53ig1V8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 2268 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2872	2268	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2268	1908	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	WerFault.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	WerFault.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	WerFault.exe
PID 2268 wrote to memory of 2872	2268	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 220
3⤵
- Program crash
PID:2872

memory/2268-0-0x0000000074DD0000-0x0000000074DD8000-memory.dmp

Filesize
32KB

Download