f1416fdec43d4faefe704e392a2a35f79a924edc499857f2148de8d3b41cc4a4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:25

Target

$PLUGINSDIR/nxs.dll
Size

6KB
MD5

8ca09b6200ffa05b54c6672d855beb4a
SHA1

daa16fe49c8b2250e9d2383b861cda51f876de49
SHA256

033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3
SHA512

6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14
SSDEEP

48:qnnScipSivON+tPTCkWqjqoay6NvC9A220B20BNatQK5zAgQIl0YawUy11TKcZ8Q:an3N+2AjqoWvC5VRxMLawvxM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2028	2080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
2⤵
PID:2028