16a00880f3f5c82e93e3b60a0e79c0c29b9e0a5ec1b88e275a5915f6577451d9

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 23:21

Target

$PLUGINSDIR/nxs.dll
Size

6KB
MD5

8ca09b6200ffa05b54c6672d855beb4a
SHA1

daa16fe49c8b2250e9d2383b861cda51f876de49
SHA256

033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3
SHA512

6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14
SSDEEP

48:qnnScipSivON+tPTCkWqjqoay6NvC9A220B20BNatQK5zAgQIl0YawUy11TKcZ8Q:an3N+2AjqoWvC5VRxMLawvxM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
  2⤵
  PID:1624