d07a3ca08c9fc3843e8e6c741db577513ff49a863598ce9a32c8199d3017fc64

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:51

Target

$PLUGINSDIR/nsProcEx.dll
Size

24KB
MD5

0216cab025a4ea223141f66cbe14ccaf
SHA1

b08b563d5fd794e17208912e8237c961bca5516f
SHA256

c5c30c304347226e4ae6b758ba6ba0589cf1c0aee55886c4354859088bf88cf7
SHA512

e870aa7381e459e4114529efbfe0a354216b8e846c7c60e550749c6c625b98f8633da5e30192737a5f65de387f9497eebaf6502615cbb6fa16da5b8c5574207a
SSDEEP

96:HsZxclQljYIyBzL0sK13V0JMFwjmpsbIk+pszeqQRr1quCo2of1:Hcxf9pyBzL0P13CMYskVzeqQ2jo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30
PID 1988 wrote to memory of 2060	1988	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcEx.dll,#1
  2⤵
  PID:2060