c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 02:56

Target
$PLUGINSDIR/nsExec.dll
Size 6KB
Sample240711-de4apsvgkm
SHA256 e18984e78d58b2383f2c1e8ed0000088ee8d9d469345383618f179176fcddff6
MD5 fdee755c4987e9859e0eec130ee22efd
SHA1 ba32823881a98da6b92eee1d866be2b3a20c6e5d
SHA512 31ba3dad22fd9b78ab3f6017c4373c923d048cf0c010900a131c4533ef185d408a88052aa4cf6184dbe484d44aab9cfa94a052185cf0b9ad19286ed921e4723f
SSDEEP 96:ft4Vl/7Lo1UBrob9ljNEUgD7cyuM1x9XkraK2A2KAB5VVDyssKZ:ft4Vlw1Iul5J8T1vK20I5VVGsb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	4056	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4056	1204	rundll32.exe	82
PID 1204 wrote to memory of 4056	1204	rundll32.exe	82
PID 1204 wrote to memory of 4056	1204	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 612
    3⤵
    - Program crash
    PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4056 -ip 4056
1⤵
PID:4728