ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:16

Target

$PLUGINSDIR/nsExec.dll
Size

15KB
MD5

78bda400d7b80858c014fc79bd8fc49b
SHA1

f5bb0e85ba892611cf79b3c2756e87a59e1e213c
SHA256

6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4
SHA512

95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc
SSDEEP

384:ogrwgTzylQKaOqJVgNyYLI84pj8vlHith5kCCY4gcGNGb5hiX8ZpHC9:ogrVi9aOYgoQsEtiQgiriXiR+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1744	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 352 wrote to memory of 1744	352	rundll32.exe	28
PID 1744 wrote to memory of 1748	1744	rundll32.exe	29
PID 1744 wrote to memory of 1748	1744	rundll32.exe	29
PID 1744 wrote to memory of 1748	1744	rundll32.exe	29
PID 1744 wrote to memory of 1748	1744	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 224
    3⤵
    - Program crash
    PID:1748