Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:11
Static task
static1
Behavioral task
behavioral1
Sample
b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963
-
SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa
-
SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde
-
SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea
-
SSDEEP
96:z0OBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uPHwEX:4tZKtrAJJJbP7iEHEbN8Ved0Ph
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2156 844 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 2748 wrote to memory of 844 2748 rundll32.exe rundll32.exe PID 844 wrote to memory of 2156 844 rundll32.exe WerFault.exe PID 844 wrote to memory of 2156 844 rundll32.exe WerFault.exe PID 844 wrote to memory of 2156 844 rundll32.exe WerFault.exe PID 844 wrote to memory of 2156 844 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 2203⤵
- Program crash