9f2830a19edaacf690e6626e58b201d747a5a510777e5e92acf42a4efd28ddb6

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/03/2024, 05:18

Target
$PLUGINSDIR/nsExec.dll
Size 6KB
Sample240301-fzpddsdf32
SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
MD5 14f5984b926208de2aafb55dd9971d4a
SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1584	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 2016 wrote to memory of 1584	2016	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29
PID 1584 wrote to memory of 2188	1584	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 224
    3⤵
    - Program crash
    PID:2188