4a0b83817f7e10ccaf4f73a8317c132fef767f646b5669e28d509c935910ef79

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 03:36

Target
NsResize.dll
Size 60KB
Sample240501-d5zefafa2s
SHA256 ef2d114896f07fc20aed5c3045754de0103813aa31bedb188262cec6fb3263dd
MD5 9c655b0c142db0494026c1ebb1b3923f
SHA1 2dbebe42968e78200688e40ab5b8d25bf8e0b4df
SHA512 51d7efab18f6909daf61534befa2e20eec437c24114f7c21b383004806d4b8869dc12395a972965c89dbeb66fe0282833207b5aa93ec7f085ca7054d0a0d9f1d
SSDEEP 768:qGFZmKGqWJ0hYkuyws9yon9dmkVL8L+vR/2nArYDRjrn9To+:q6mfmYkuX3onDmkVLm+o7DB9To
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4568	3772	WerFault.exe	82
4504	3772	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3772	1900	rundll32.exe	82
PID 1900 wrote to memory of 3772	1900	rundll32.exe	82
PID 1900 wrote to memory of 3772	1900	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NsResize.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NsResize.dll,#1
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 568
    3⤵
    - Program crash
    PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 796
    3⤵
    - Program crash
    PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3772 -ip 3772
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3772 -ip 3772
1⤵
PID:4000