952e53e74c1bb7329959c54edaa6282aaa112e0332563c0fc3f6a8cc150c0119

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18/06/2024, 15:10

Target
$PLUGINSDIR/nsExec.dll
Size 7KB
Sample240618-sj1spsyfla
SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
MD5 b4579bc396ace8cafd9e825ff63fe244
SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	1744	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 2056 wrote to memory of 1744	2056	rundll32.exe	28
PID 1744 wrote to memory of 1704	1744	rundll32.exe	29
PID 1744 wrote to memory of 1704	1744	rundll32.exe	29
PID 1744 wrote to memory of 1704	1744	rundll32.exe	29
PID 1744 wrote to memory of 1704	1744	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 220
    3⤵
    - Program crash
    PID:1704