9bc70a2e37123deefafa303ca59ea0dd304b17e2f0288b3b6730104da0e0f6f1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 08:53

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

3eb4cd50dcb9f5981f5408578cb7fb70
SHA1

13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA256

1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
SHA512

5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP

96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2408	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2408 wrote to memory of 2092	2408	rundll32.exe	31
PID 2408 wrote to memory of 2092	2408	rundll32.exe	31
PID 2408 wrote to memory of 2092	2408	rundll32.exe	31
PID 2408 wrote to memory of 2092	2408	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 224
    3⤵
    - Program crash
    PID:2092