387ae43099fee9234854e9c8ebe1b4ae42c22f5b952446334c6335587899deee

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 16:01

Target

bin/k2epack/Plugins/nsExec.dll
Size

6KB
MD5

4ad87730940d1031b84a07fd9414cb5c
SHA1

0cb8d98b915206131d036b6898c2e4793d64891f
SHA256

87be9e03fce817bb8567e03d6ce89aba15ec8cbdb2c6d11161da393ec0c876ad
SHA512

939accab06c5bcbf9ee1cb2e6764cef65d5ec089e7ba3f461cb95749faea9ce21e2085d7f1c9740d2d65a72fcc5b47cbc3646fdcb1cc402c917ab5807da18749
SSDEEP

96:iXMt8WeUBhgiVhCnzC/Fjgz+GWrhKf1hhUHlYInN5SM+L9IWdFyVPNKI+:lpBhgwhQzCtEz+GWs9hkOmMVd8VPNm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	1812	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1444 wrote to memory of 1812	1444	rundll32.exe	28
PID 1812 wrote to memory of 1808	1812	rundll32.exe	29
PID 1812 wrote to memory of 1808	1812	rundll32.exe	29
PID 1812 wrote to memory of 1808	1812	rundll32.exe	29
PID 1812 wrote to memory of 1808	1812	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\k2epack\Plugins\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\k2epack\Plugins\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 224
    3⤵
    - Program crash
    PID:1808