b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 19:09

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

4a2f4fe4a3ad1de56ee6bf7dd4923963
SHA1

7cc68b94448c964fd99904e5784b059aed4d5daa
SHA256

89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde
SHA512

4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea
SSDEEP

96:z0OBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uPHwEX:4tZKtrAJJJbP7iEHEbN8Ved0Ph

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2428	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2412 wrote to memory of 2428	2412	rundll32.exe	28
PID 2428 wrote to memory of 2172	2428	rundll32.exe	29
PID 2428 wrote to memory of 2172	2428	rundll32.exe	29
PID 2428 wrote to memory of 2172	2428	rundll32.exe	29
PID 2428 wrote to memory of 2172	2428	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 220
    3⤵
    - Program crash
    PID:2172