13b01dfe788827f1fff3cc2f0ce82b68cc97d795bdc7efbe634115760bda8237

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 17:53

Target

$PLUGINSDIR/NSUtils.dll
Size

22KB
MD5

9b82792f5cb4c3f0540861ec32a1b093
SHA1

070ad16ec9c009462117069e45a2cee34fd4fc89
SHA256

74c1b58c62c897845d4eb024b1660e2232e789de89074b5e66427ea9dfb6dcfd
SHA512

3de0088fc5389ab09564a2fc6218dfc94b78d46d20127733283d8338e38b9457393d37f645147592dc15756b60ed5f4ab009252b1293436dd0492df0e05e7050
SSDEEP

384:7lSDRe6W3+PN6PR1LK6RZqCkCL5vMEAB7uNI+Er09y58VSwVh1l91:P6ZN6JbynB7uNYr0E58kah1l91

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	3108	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 3108	4632	rundll32.exe	83
PID 4632 wrote to memory of 3108	4632	rundll32.exe	83
PID 4632 wrote to memory of 3108	4632	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSUtils.dll,#1
  2⤵
  PID:3108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 656
    3⤵
    - Program crash
    PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3108 -ip 3108
1⤵
PID:2524