f6e8ee077ac63b2279d6711d3dd2166ca6be245d1ea2a55d728ef92d9176f5e5

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 06:34

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

3eb4cd50dcb9f5981f5408578cb7fb70
SHA1

13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA256

1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
SHA512

5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP

96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2688	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2836 wrote to memory of 2688	2836	rundll32.exe	28
PID 2688 wrote to memory of 2096	2688	rundll32.exe	29
PID 2688 wrote to memory of 2096	2688	rundll32.exe	29
PID 2688 wrote to memory of 2096	2688	rundll32.exe	29
PID 2688 wrote to memory of 2096	2688	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 224
    3⤵
    - Program crash
    PID:2096