22894ff22c8ce3cba8869242622460bb9168deb05e724bf6371433df60d6280f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 01:51

Target

$PLUGINSDIR/nxs.dll
Size

6KB
MD5

8ca09b6200ffa05b54c6672d855beb4a
SHA1

daa16fe49c8b2250e9d2383b861cda51f876de49
SHA256

033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3
SHA512

6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14
SSDEEP

48:qnnScipSivON+tPTCkWqjqoay6NvC9A220B20BNatQK5zAgQIl0YawUy11TKcZ8Q:an3N+2AjqoWvC5VRxMLawvxM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28
PID 2188 wrote to memory of 1752	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
  2⤵
  PID:1752