1f7f8fa2a0d1850a1753edd61fc2ddfd67031a15b65929469c044dc8c751de03

Analysis

max time kernel
137s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 07:38

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

6b174eb4d11c11ad5d8c8653f09e60c3
SHA1

222b75fa7c03707d8664817a2fd7db142f33867b
SHA256

b4ec96eda12eb0cbd593d4a65bb9ebb9055244f16a19dc976ba57bc552763419
SHA512

3d847f863b367b7822a3a2422846bb15d5f68408af937224e19cf0f5fed8632738701d42d1f3a251b9ed69b3ce1a1698314698ac22a14ef38504415daf5aca09
SSDEEP

96:znYPt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KA4e3VUxQvLL1mKZ:7YPt4Vlw1Iul5J8T1vK20m3VUaLL1l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	3152	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3152	624	rundll32.exe	83
PID 624 wrote to memory of 3152	624	rundll32.exe	83
PID 624 wrote to memory of 3152	624	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 612
    3⤵
    - Program crash
    PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3152 -ip 3152
1⤵
PID:1388