9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 13:31

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

3eb4cd50dcb9f5981f5408578cb7fb70
SHA1

13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA256

1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
SHA512

5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP

96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2260	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2232 wrote to memory of 2260	2232	rundll32.exe	28
PID 2260 wrote to memory of 2244	2260	rundll32.exe	29
PID 2260 wrote to memory of 2244	2260	rundll32.exe	29
PID 2260 wrote to memory of 2244	2260	rundll32.exe	29
PID 2260 wrote to memory of 2244	2260	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 224
    3⤵
    - Program crash
    PID:2244