387ae43099fee9234854e9c8ebe1b4ae42c22f5b952446334c6335587899deee

Analysis

max time kernel
130s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:01

Target

bin/k2epack/Plugins/nsExec.dll
Size

6KB
MD5

4ad87730940d1031b84a07fd9414cb5c
SHA1

0cb8d98b915206131d036b6898c2e4793d64891f
SHA256

87be9e03fce817bb8567e03d6ce89aba15ec8cbdb2c6d11161da393ec0c876ad
SHA512

939accab06c5bcbf9ee1cb2e6764cef65d5ec089e7ba3f461cb95749faea9ce21e2085d7f1c9740d2d65a72fcc5b47cbc3646fdcb1cc402c917ab5807da18749
SSDEEP

96:iXMt8WeUBhgiVhCnzC/Fjgz+GWrhKf1hhUHlYInN5SM+L9IWdFyVPNKI+:lpBhgwhQzCtEz+GWs9hkOmMVd8VPNm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	4512	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4512	2000	rundll32.exe	83
PID 2000 wrote to memory of 4512	2000	rundll32.exe	83
PID 2000 wrote to memory of 4512	2000	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\k2epack\Plugins\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\k2epack\Plugins\nsExec.dll,#1
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 612
    3⤵
    - Program crash
    PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4512 -ip 4512
1⤵
PID:2300