8df05e255ce1317db4abb9d84c00917f23d3d0ef9ca0bde0cd05e1d7d50efed6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 06:06

Target

$TEMPfolder/DomriuAdoej/nssckbi.dll
Size

407KB
MD5

ba406d87af2f892c1b59628899fbcb10
SHA1

6392231726ed0759352c8e11c699a17b2519e528
SHA256

7a5c06a5050881b747eae24e77a4a4ec0f66752c4e0d89e447cded177629965f
SHA512

f2df98b3172eea84a6b2948adf6ff2d48d88f9e393822d776203d5c930628c4b850cb8b92ba60993dec1d25f0e8f6391ca545d2259da1b7a53bece22c7251155
SSDEEP

6144:dJz2s9oBgdMTWfpUwFygo5zUM38MEuL9ewNkUE0kUq:7f9OgWTWfpf0gmzY49zNkUE0kUq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	1880	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1880 wrote to memory of 2092	1880	rundll32.exe	29
PID 1880 wrote to memory of 2092	1880	rundll32.exe	29
PID 1880 wrote to memory of 2092	1880	rundll32.exe	29
PID 1880 wrote to memory of 2092	1880	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\nssckbi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\nssckbi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 232
    3⤵
    - Program crash
    PID:2092