22894ff22c8ce3cba8869242622460bb9168deb05e724bf6371433df60d6280f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 01:51

Target
$PLUGINSDIR/nxs.dll
Size 6KB
Sample240512-b91f7adh34
SHA256 033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3
MD5 8ca09b6200ffa05b54c6672d855beb4a
SHA1 daa16fe49c8b2250e9d2383b861cda51f876de49
SHA512 6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14
SSDEEP 48:qnnScipSivON+tPTCkWqjqoay6NvC9A220B20BNatQK5zAgQIl0YawUy11TKcZ8Q:an3N+2AjqoWvC5VRxMLawvxM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4088	4564	rundll32.exe	83
PID 4564 wrote to memory of 4088	4564	rundll32.exe	83
PID 4564 wrote to memory of 4088	4564	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
  2⤵
  PID:4088