284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:47

Target

$PLUGINSDIR/nsWindows.dll
Size

16KB
MD5

552fff61cb72928253be15861aaffc1d
SHA1

126b2b28958dd38787bc5a564248334c5b89f786
SHA256

e03931b60dfc3fc5a387c037af2f8f04377d73a347f1d1e8f4cc8aad8efca1d1
SHA512

89ccd6fdda7a72f8f74a7ea84a5a15961e9903be7afe6648f4615b26e3231552f75707696e55485740e3fd2a80ffbf66401bc95176f1a313b90d41db63042b5d
SSDEEP

192:fqUyuov2gQWaoJNMSsSCL8XPrw3BOGZnYe+PjPSrcy++v1Etr9ZCspE+TMQrGlmy:fqUyuov2gPriIXPrw3fnYPLltAeMPlf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	2916	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2868 wrote to memory of 2916	2868	rundll32.exe	28
PID 2916 wrote to memory of 2320	2916	rundll32.exe	29
PID 2916 wrote to memory of 2320	2916	rundll32.exe	29
PID 2916 wrote to memory of 2320	2916	rundll32.exe	29
PID 2916 wrote to memory of 2320	2916	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWindows.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWindows.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 244
    3⤵
    - Program crash
    PID:2320