035c9942570c04ae3519e14fc8846933c5c99a59d2a3cf9a45a4166e119bc853

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:23

Target
$PLUGINSDIR/nsExec.dll
Size 6KB
Sample240417-pkfmdaef26
SHA256 c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9
MD5 b38561661a7164e3bbb04edc3718fe89
SHA1 f13c873c8db121ba21244b1e9a457204360d543f
SHA512 fedcaac20722de3519382011ccf22314af3edcd11b69f814db14710966853b69b9b5fc98383edcdb64d050ff825264eaba27b1c5adfe61d1fc9d77f13a052ced
SSDEEP 96:f7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNPS3e:zXhHR0aTQN4gRHdMqJVgNPR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2264	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2236 wrote to memory of 2264	2236	rundll32.exe	28
PID 2264 wrote to memory of 2272	2264	rundll32.exe	29
PID 2264 wrote to memory of 2272	2264	rundll32.exe	29
PID 2264 wrote to memory of 2272	2264	rundll32.exe	29
PID 2264 wrote to memory of 2272	2264	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 228
    3⤵
    - Program crash
    PID:2272