91917dfa8e7c9639594e986d2818120e113eeddbca706ecf0e2870ab42742d7b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:39

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

6b174eb4d11c11ad5d8c8653f09e60c3
SHA1

222b75fa7c03707d8664817a2fd7db142f33867b
SHA256

b4ec96eda12eb0cbd593d4a65bb9ebb9055244f16a19dc976ba57bc552763419
SHA512

3d847f863b367b7822a3a2422846bb15d5f68408af937224e19cf0f5fed8632738701d42d1f3a251b9ed69b3ce1a1698314698ac22a14ef38504415daf5aca09
SSDEEP

96:znYPt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KA4e3VUxQvLL1mKZ:7YPt4Vlw1Iul5J8T1vK20m3VUaLL1l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2168	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2156 wrote to memory of 2168	2156	rundll32.exe	28
PID 2168 wrote to memory of 2800	2168	rundll32.exe	29
PID 2168 wrote to memory of 2800	2168	rundll32.exe	29
PID 2168 wrote to memory of 2800	2168	rundll32.exe	29
PID 2168 wrote to memory of 2800	2168	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 220
    3⤵
    - Program crash
    PID:2800