9990a8d638476fa95989232f9bea2c6807e5e9551a33f4d98c4adcaac646f665 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 21:23

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

14f5984b926208de2aafb55dd9971d4a
SHA1

e5afe0b80568135d3e259c73f93947d758a7b980
SHA256

030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
SHA512

e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
SSDEEP

96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 2872 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 2872	2164	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2488	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2488	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2488	2872	rundll32.exe	WerFault.exe
PID 2872 wrote to memory of 2488	2872	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 224
3⤵
- Program crash
PID:2488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...