d07a3ca08c9fc3843e8e6c741db577513ff49a863598ce9a32c8199d3017fc64

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 22:51

Target

$PLUGINSDIR/nsProcEx.dll
Size

24KB
MD5

0216cab025a4ea223141f66cbe14ccaf
SHA1

b08b563d5fd794e17208912e8237c961bca5516f
SHA256

c5c30c304347226e4ae6b758ba6ba0589cf1c0aee55886c4354859088bf88cf7
SHA512

e870aa7381e459e4114529efbfe0a354216b8e846c7c60e550749c6c625b98f8633da5e30192737a5f65de387f9497eebaf6502615cbb6fa16da5b8c5574207a
SSDEEP

96:HsZxclQljYIyBzL0sK13V0JMFwjmpsbIk+pszeqQRr1quCo2of1:Hcxf9pyBzL0P13CMYskVzeqQ2jo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4872	2236	rundll32.exe	83
PID 2236 wrote to memory of 4872	2236	rundll32.exe	83
PID 2236 wrote to memory of 4872	2236	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcEx.dll,#1
  2⤵
  PID:4872