a24c03e63449db0f994c715115c7648e88182888305be3554ef8f9a9215a0501 | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 04:45

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsExec.dll
Size

11KB
MD5

d9624f8a2014d31c4f114b78e20ad6b3
SHA1

0c1b5761bc42372778ab5af27165cc52666924c4
SHA256

1822b4b0c0111e82361ddf3d603d14392d80908c17d51d187bd2aa8d48e104e9
SHA512

db2015d2f2783b1734a8b92154d9fe454d212ff586b66fb235986872b0ee5dc6c6e7d8498fe000097b3fa11aff2f6136dd28b618408d85995602e2664b941c01
SSDEEP

192:JFArL9YKCLmpfHcQOliHERKXWRChDuatU4atUCvqx9:LcFCuZO4kRKG0ptUntUCyx9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2308	992	rundll32.exe	28
PID 992 wrote to memory of 2308	992	rundll32.exe	28
PID 992 wrote to memory of 2308	992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 992 -s 88
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-0-0x000007FEFBE90000-0x000007FEFBE9A000-memory.dmp

Filesize
40KB

Download