1f7f8fa2a0d1850a1753edd61fc2ddfd67031a15b65929469c044dc8c751de03

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:38

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

6b174eb4d11c11ad5d8c8653f09e60c3
SHA1

222b75fa7c03707d8664817a2fd7db142f33867b
SHA256

b4ec96eda12eb0cbd593d4a65bb9ebb9055244f16a19dc976ba57bc552763419
SHA512

3d847f863b367b7822a3a2422846bb15d5f68408af937224e19cf0f5fed8632738701d42d1f3a251b9ed69b3ce1a1698314698ac22a14ef38504415daf5aca09
SSDEEP

96:znYPt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KA4e3VUxQvLL1mKZ:7YPt4Vlw1Iul5J8T1vK20m3VUaLL1l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	1532	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1368 wrote to memory of 1532	1368	rundll32.exe	28
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29
PID 1532 wrote to memory of 2476	1532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 224
    3⤵
    - Program crash
    PID:2476