4fce508cfa7a31c7e19aec69e49725cb67206d482584e407c5c208cc1dc1ba5b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 09:10

Target

$PLUGINSDIR/nswg.dll
Size

97KB
MD5

9358e24d317c088b24765f5df3774249
SHA1

cd91c72f3b67fa0910932f3affa36cb2865eac50
SHA256

73f58c0a251b09191df46bf96cfcc4dcbfaf61adcbb0f0ac274c79f46e263221
SHA512

c8747bace869b9a49e151abc1eb345e1294c000b218212f557850b14d47b954164a68517c8f824bf015314faea221408da3473c17a92bca4e8bd5a8d269d2b87
SSDEEP

1536:EjHYwoNKCY8NbhCrnlPGwaMJsmok6U0FuWZlkcXcHwCOF/UR6p+LvCUDkHw4r/gy:EjcNKEYgmbSZZWxRw+LvCUDk7rkO7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28
PID 2032 wrote to memory of 1640	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nswg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nswg.dll,#1
  2⤵
  PID:1640