879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 00:30

Target

$PLUGINSDIR/NScurl.dll
Size

3.8MB
MD5

7a644e6337e0b2908de49746da16facb
SHA1

03a331e701543e9d5499e178e475cb4374f51cf9
SHA256

1a2eecda662f9ae819ff0f716e67125867951b0d2d49c841d202f866ab3e3aad
SHA512

7adfa468d0dede904325f7e7283a12b06738d9699bedafdb04816254ef97a34c7a80f5af893dc4a8a8f04b4bc1a5bbccd8875a5fc89efddb83e2f72351ca9e08
SSDEEP

98304:2gpYcx1NeQUDuQqF6moZR2GSb5BDoo/inycARfoD7iLHVBg5p1wUVZuA:2qpx1NeQUDZqYmoZR2GSbnE8cMfoD7uw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28
PID 2056 wrote to memory of 2088	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
  2⤵
  PID:2088