98598c90bd75b930aba968467f4b540a5784aa28612b8010d8a9cf31992843c6

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 19:05

Target

$PLUGINSDIR/NScurl.dll
Size

3.6MB
MD5

16e134ec014d74e9b798c9b3fae3ddcc
SHA1

1a8cc259f7b193018167484c30d8803b09ed228e
SHA256

eda02e626e8ca71dbff5389c062f9e9542661b43413b0a37ae3d262567145ce2
SHA512

3e5742934076066125b82f4b2da45a499b22440252dff4ec14660fc688f075f886ac76de89f4c6647a8c85e483c83507edfcb22e3dbe3363e509ae18b1c4636e
SSDEEP

98304:yXbm8hg9ZNN1FVyQ2Ufa2Zx/tlILkUYhK:yC8hg9vj3nfam/rykUiK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2196 1624 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2196	1624	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 2972 wrote to memory of 1624	2972	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2196	1624	rundll32.exe	WerFault.exe
PID 1624 wrote to memory of 2196	1624	rundll32.exe	WerFault.exe
PID 1624 wrote to memory of 2196	1624	rundll32.exe	WerFault.exe
PID 1624 wrote to memory of 2196	1624	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 224
    3⤵
    - Program crash
    PID:2196

memory/1624-0-0x0000000074B50000-0x0000000074EEA000-memory.dmp

Filesize
3.6MB

Download