209a4474cb7f906d4fd6c7df839841b7944b4917ec5f65bc0c92acfa552f9040

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:44

Target

$PLUGINSDIR/nsProcess2.dll
Size

35KB
MD5

6e96ea8b0dfdb326c0852a5b64d920a6
SHA1

5ea182cb6ae5c104ca064fa8464df8ed1904eaa7
SHA256

b8762c09c2b45fc836c65a9052951de05177651d278e4cf154c754d9f5573e7a
SHA512

02d0bd8f16ddad829b80764926f1e6dcfb35b60fbce02bec0a7fc2011164d86f633074af012de71fae33b90732ec4c7633f8a70ab24c19717926757f9c56fb4f
SSDEEP

768:TTc0PYmtVrjWQ7P4hEnn2OEDgzAwvc3F:Pc0P7VrjWQMw6Z3F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	2036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 1256 wrote to memory of 2036	1256	rundll32.exe	28
PID 2036 wrote to memory of 1732	2036	rundll32.exe	29
PID 2036 wrote to memory of 1732	2036	rundll32.exe	29
PID 2036 wrote to memory of 1732	2036	rundll32.exe	29
PID 2036 wrote to memory of 1732	2036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 220
    3⤵
    - Program crash
    PID:1732