Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
04aea1458bbe0debfdc6cbd993d9d3ebf52e5742cac8d5ad53a44ac2c8010d12.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
04aea1458bbe0debfdc6cbd993d9d3ebf52e5742cac8d5ad53a44ac2c8010d12.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
3eb4cd50dcb9f5981f5408578cb7fb70
-
SHA1
13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
-
SHA256
1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
-
SHA512
5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
-
SSDEEP
96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2340 1388 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1872 wrote to memory of 1388 1872 rundll32.exe rundll32.exe PID 1388 wrote to memory of 2340 1388 rundll32.exe WerFault.exe PID 1388 wrote to memory of 2340 1388 rundll32.exe WerFault.exe PID 1388 wrote to memory of 2340 1388 rundll32.exe WerFault.exe PID 1388 wrote to memory of 2340 1388 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 2243⤵
- Program crash
PID:2340