0c3a38ca1a01a40daf13699cae74d8903aeb6362f75611dbd8df3430b850026b

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 01:03

Target
$PLUGINSDIR/nsExec.dll
Size 6KB
Sample240417-bevmfshc53
SHA256 938580b466533dfa1461e9858fd106b60e1a52b713380915cc03afd3e4b4573c
MD5 98bdb37511634dad8d1236d91d373b26
SHA1 778cf74b4f8860cc378fa4e61aeba318197783ce
SHA512 5a7a903c2346750f20c0b41ceb6259bc7a5c9c6779acfeef94e0cea756aebabef58fdd83389353a165530279ec74ff20b903fc9a11acf475ef9471bd5e8d140e
SSDEEP 96:CjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkND3m+s:nbogRtJzTlNR8qD85uGgmkNK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	2340	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2224 wrote to memory of 2340	2224	rundll32.exe	28
PID 2340 wrote to memory of 1856	2340	rundll32.exe	29
PID 2340 wrote to memory of 1856	2340	rundll32.exe	29
PID 2340 wrote to memory of 1856	2340	rundll32.exe	29
PID 2340 wrote to memory of 1856	2340	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 228
    3⤵
    - Program crash
    PID:1856