0625f84f174f72e98cb67251a549638b8997012701ae7e47d6fa348567bfd7ba

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 10:58

Target

$PLUGINSDIR/nsExec.dll
Size

7KB
MD5

ec9c99216ef11cdd85965e78bc797d2c
SHA1

1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256

c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA512

35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
SSDEEP

96:JwzdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuHUDQ:JTkDr/HA5v6G2IElFernNQZGdHs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	4788	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4788	2212	rundll32.exe	88
PID 2212 wrote to memory of 4788	2212	rundll32.exe	88
PID 2212 wrote to memory of 4788	2212	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 612
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4788 -ip 4788
1⤵
PID:532