ebfd2e8e69cabc890d5321e64a578ff068ebe19a356c6ae47926961c78699644

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:33

Target

$PLUGINSDIR/nshist.dll
Size

39KB
MD5

d3686f7113ae84568624746249cbec6e
SHA1

a5849fd8e5722f91e58eec28244e9d54387f5912
SHA256

0d8fc9dc3894ccab669eee7e07c7d53a85ee191069c5e02140a23bc19461ec39
SHA512

18dec8ef52c343587e7790bbb4a0eca9a02efd37ca347e2ed72d03c2021486b240c8d451c2d04e1b564c80eee437b4730d53c7702524159291255a15e6de1b6d
SSDEEP

384:R+e5X+ZjXEP40ozKzdp1L99uwvwXjnxsEVxBCcN7avJtgJ4lxFZZQRiMC3vQQnoz:1cIQk9R9uwvwXdsQxJN+vG4BZIlQG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	776	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 2240 wrote to memory of 776	2240	rundll32.exe	28
PID 776 wrote to memory of 1240	776	rundll32.exe	29
PID 776 wrote to memory of 1240	776	rundll32.exe	29
PID 776 wrote to memory of 1240	776	rundll32.exe	29
PID 776 wrote to memory of 1240	776	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nshist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nshist.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 232
    3⤵
    - Program crash
    PID:1240