Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
16/05/2024, 17:46 UTC
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
ec0504e6b8a11d5aad43b296beeb84b2
-
SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c
-
SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
-
SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
SSDEEP
96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 6163⤵
- Program crash
-
-
Network
-
DNS25.251.17.2.in-addr.arpaRemote address:8.8.8.8:53Request25.251.17.2.in-addr.arpaIN PTRResponse25.251.17.2.in-addr.arpaIN PTRa2-17-251-25deploystaticakamaitechnologiescom -
DNS30.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
DNS226.162.46.104.in-addr.arpaRemote address:8.8.8.8:53Request226.162.46.104.in-addr.arpaIN PTRResponse
-
DNS152.107.17.2.in-addr.arpaRemote address:8.8.8.8:53Request152.107.17.2.in-addr.arpaIN PTRResponse152.107.17.2.in-addr.arpaIN PTRa2-17-107-152deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:5325.251.17.2.in-addr.arpadns
DNS Request
25.251.17.2.in-addr.arpa
-
8.8.8.8:5330.243.111.52.in-addr.arpadns
DNS Request
30.243.111.52.in-addr.arpa
-
8.8.8.8:53226.162.46.104.in-addr.arpadns
DNS Request
226.162.46.104.in-addr.arpa
-
8.8.8.8:53152.107.17.2.in-addr.arpadns
DNS Request
152.107.17.2.in-addr.arpa