476fcd091b44ee8aae4a754e2f184c08e03cd3c8c7277e3f71184acf0304aa46

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 11:17

Target

$PLUGINSDIR/nswg.dll
Size

11KB
MD5

ba27c6eac527078c6786b585367d6b59
SHA1

cbc4d849bb19719ec755dbdf94c074cbfb78ba81
SHA256

28a64b3c13f4ec4b168a9f7b30558f247063c2a95e2bfbe4e2ff58d3c8095ccd
SHA512

124f6da8df90919721037f4f957999a5deeaed8e06004e55479673d57d23f06472fd1acde143a2cd0cd4ca46a167c6b6ba68b57f104505553b7a70c679eb2580
SSDEEP

192:Oqh5wY9sD9hNfOHfrNAA9C3eFeuFGMHYGd+mnabgKwY3d1mwabuwGPY2wNKPf6xI:3jwosZhN2fr6A86xw0MWGRtwNKQ9OWWL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28
PID 2200 wrote to memory of 2068	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nswg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nswg.dll,#1
  2⤵
  PID:2068