Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 15:51
Static task
static1
Behavioral task
behavioral1
Sample
Revised PI_2024.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Revised PI_2024.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
3eb4cd50dcb9f5981f5408578cb7fb70
-
SHA1
13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
-
SHA256
1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
-
SHA512
5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
-
SSDEEP
96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2188 2128 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2956 wrote to memory of 2128 2956 rundll32.exe rundll32.exe PID 2128 wrote to memory of 2188 2128 rundll32.exe WerFault.exe PID 2128 wrote to memory of 2188 2128 rundll32.exe WerFault.exe PID 2128 wrote to memory of 2188 2128 rundll32.exe WerFault.exe PID 2128 wrote to memory of 2188 2128 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 2243⤵
- Program crash
PID:2188