4245b59eb49f9ea2596ed1791ea2c81173acbfdfa2ceaf8e17ab418ace71d847

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 18:10

Target

$PLUGINSDIR/NsLauncher.dll
Size

7.3MB
MD5

e289f003033fb7d3d52ff9afccbd3677
SHA1

2083fb9828ecc87d3b274208be0e8b88ba37136c
SHA256

e243bcd7575fdff522a23d97a848f562a52d484cea06151642ec5e36773a1b87
SHA512

99b9ec5c405b86754dd48959643080b5dccca4231e3092c1be77a8e86c5dfc893122b7d04cb2a87e4c21ce900f7eace488d01494045381cb96055a96cadc7863
SSDEEP

196608:JGGbkta6MDLZEJStWrXW3DBwI23DJXtFW1ci:JjGa6MDLZEQtWTW3Do3DJSci

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	3048	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3000 wrote to memory of 3048	3000	rundll32.exe	28
PID 3048 wrote to memory of 2144	3048	rundll32.exe	29
PID 3048 wrote to memory of 2144	3048	rundll32.exe	29
PID 3048 wrote to memory of 2144	3048	rundll32.exe	29
PID 3048 wrote to memory of 2144	3048	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsLauncher.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsLauncher.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 264
    3⤵
    - Program crash
    PID:2144