15b419c6862305e5f87b295066bbdf2e8ee83ce08f6913498e8b060c5a93580a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 01:06

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

6b174eb4d11c11ad5d8c8653f09e60c3
SHA1

222b75fa7c03707d8664817a2fd7db142f33867b
SHA256

b4ec96eda12eb0cbd593d4a65bb9ebb9055244f16a19dc976ba57bc552763419
SHA512

3d847f863b367b7822a3a2422846bb15d5f68408af937224e19cf0f5fed8632738701d42d1f3a251b9ed69b3ce1a1698314698ac22a14ef38504415daf5aca09
SSDEEP

96:znYPt4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KA4e3VUxQvLL1mKZ:7YPt4Vlw1Iul5J8T1vK20m3VUaLL1l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
440	4836	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4836	1596	rundll32.exe	82
PID 1596 wrote to memory of 4836	1596	rundll32.exe	82
PID 1596 wrote to memory of 4836	1596	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 612
    3⤵
    - Program crash
    PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4836 -ip 4836
1⤵
PID:436