ff8c11f132ed73ea6cbdf3dae4f8d02886392d66c1adfef3ad52f5a1f5022cb5

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 15:18

Target

Data/Noesis/plugins/NoesisPython.dll
Size

4.4MB
MD5

958a5ddd1caf3b9112668daf677dd278
SHA1

72c6b25ea0d4f7ca80d141fb9b9edaf6a84981b1
SHA256

49c9c3655ca792e16cc361e1ac320cfc849c28aeff62e344f06fb1e64d09d618
SHA512

165ce2dd34449765f0121c1360af3dffeeb4ddc3bd9e80019c97f4971983954660d0db9b00cba79c51e08cdc2ccf24be0d1e69bb4394f5c718c187c40984ac5a
SSDEEP

98304:lfjikMGR+SJinFf1D4tIOqJfDMbHNWfblj6dMcwVmsuhr0s:L/HJiZOu4sBUTC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	2188	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2316 wrote to memory of 2188	2316	rundll32.exe	28
PID 2188 wrote to memory of 2236	2188	rundll32.exe	29
PID 2188 wrote to memory of 2236	2188	rundll32.exe	29
PID 2188 wrote to memory of 2236	2188	rundll32.exe	29
PID 2188 wrote to memory of 2236	2188	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\Noesis\plugins\NoesisPython.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\Noesis\plugins\NoesisPython.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 220
    3⤵
    - Program crash
    PID:2236