8d7c1f4f7bca64b9b9efbe2f2f6c20dbd28d9b25fdc2738b309c7e1635f20b9c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 10:24

Target

$PLUGINSDIR/nswebgui.dll
Size

157KB
MD5

d9a739b933fcebe78f5bccc005a9c36b
SHA1

cde6df6c85343dbd43fad1e888eca40cca30f117
SHA256

39a7ef02acd716addb714ef1a8748ee300f8fd14f8f030a6e9dcab236c202f37
SHA512

0090e750bcf7b3224567fa75e8832c41fd64029dd1c6a5d947aa8d12f507e4557a9ecbc26b276a2b689422c4e7f07620e2fab86d2564d7a3ce2c0cab41443ab6
SSDEEP

3072:7lWKI29CZ3JBzvwlg+wzNkX33gWb5/bC9X:0KI29CZyg+wZK3QW5bCt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	1792	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 1792 wrote to memory of 1256	1792	rundll32.exe	29
PID 1792 wrote to memory of 1256	1792	rundll32.exe	29
PID 1792 wrote to memory of 1256	1792	rundll32.exe	29
PID 1792 wrote to memory of 1256	1792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nswebgui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nswebgui.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 248
    3⤵
    - Program crash
    PID:1256