9224576d620c3e08e23bc7d24b26fa72baf7ce6b3a8e9d19732187c61bdffdb1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:48

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

c41d49cb2d1bc52dd2acea5f0558cc15
SHA1

d23ed4772fd4a3f1a5e0eb5cea3086c98f05c0ba
SHA256

dd13eece085777415a31fe61afcbbe6aaef2e3c524d9e2d9da036ca298d4626f
SHA512

15c8877900a9366c8c97cd2f848e32c5c2e8f4b6be881c87bb544758b78701dfb985b89d2935d9cbf775d21d38f8115b5980a2ec154fa724a8728702e98a7573
SSDEEP

96:/jspqRy5AOEEQsh+WvDRH3spzQreUvhiT4uF3Telac1nIqVi:/n0AOEMh+Wv9cZQKUvkTjlaB1nIqY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	2280	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 3024 wrote to memory of 2280	3024	rundll32.exe	30
PID 2280 wrote to memory of 2184	2280	rundll32.exe	31
PID 2280 wrote to memory of 2184	2280	rundll32.exe	31
PID 2280 wrote to memory of 2184	2280	rundll32.exe	31
PID 2280 wrote to memory of 2184	2280	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 224
    3⤵
    - Program crash
    PID:2184