5252e00d2dc0fa62fb4a3721826acb9b8c8198f5734003cca85887bfa2ec56f9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 09:58

Target

$PLUGINSDIR/nsProcess2.dll
Size

340KB
MD5

9168de720e09a8167915f579b9869356
SHA1

bf2b350870cd51cd12f70eacd1dcb24ef9fc37a8
SHA256

464c7250a4ba2c7be4b43adcc5262f983a3de175529b92c4069f537d666dad9b
SHA512

be1bc4ad7226154f604cae07430bad962bfb304348627acafbe7b83448459e22949a5c8ecc34984f407fca948272c040cf10511aa692876a33e01b2d00fdc987
SSDEEP

6144:jLZJwu513jRmWFtJTlDsP0Bo5q/KhpL+hINPeddRHeWcWslHsfemsHp+FiSGXfRg:jLXv5JRLPJTlDsP69qsG+Qfu3j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	1752	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1804 wrote to memory of 1752	1804	rundll32.exe	28
PID 1752 wrote to memory of 2144	1752	rundll32.exe	29
PID 1752 wrote to memory of 2144	1752	rundll32.exe	29
PID 1752 wrote to memory of 2144	1752	rundll32.exe	29
PID 1752 wrote to memory of 2144	1752	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 244
    3⤵
    - Program crash
    PID:2144