cbde95a98c42a05e295f6660f8300cd598e51cecbb6b162fd231b0d1b00b7e60

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 12:46

Target

$PLUGINSDIR/nxs.dll
Size

6KB
MD5

8ca09b6200ffa05b54c6672d855beb4a
SHA1

daa16fe49c8b2250e9d2383b861cda51f876de49
SHA256

033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3
SHA512

6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14
SSDEEP

48:qnnScipSivON+tPTCkWqjqoay6NvC9A220B20BNatQK5zAgQIl0YawUy11TKcZ8Q:an3N+2AjqoWvC5VRxMLawvxM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3448 wrote to memory of 732	3448	rundll32.exe	rundll32.exe
PID 3448 wrote to memory of 732	3448	rundll32.exe	rundll32.exe
PID 3448 wrote to memory of 732	3448	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nxs.dll,#1
  2⤵
  PID:732