83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 10:52

Target
$PLUGINSDIR/nsExec.dll
Size 6KB
Sample240508-mydntsbd35
SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
MD5 3eb4cd50dcb9f5981f5408578cb7fb70
SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2380	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2380 wrote to memory of 2628	2380	rundll32.exe	29
PID 2380 wrote to memory of 2628	2380	rundll32.exe	29
PID 2380 wrote to memory of 2628	2380	rundll32.exe	29
PID 2380 wrote to memory of 2628	2380	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 224
    3⤵
    - Program crash
    PID:2628