983b12f644e45edc4d81850e16ce5627f63cddd55505376da5f1eb1180f3b5b9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 06:47

Target

$PLUGINSDIR/nsExec.dll
Size

6KB
MD5

3eb4cd50dcb9f5981f5408578cb7fb70
SHA1

13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
SHA256

1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
SHA512

5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
SSDEEP

96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
356	2084	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 3032 wrote to memory of 2084	3032	rundll32.exe	30
PID 2084 wrote to memory of 356	2084	rundll32.exe	31
PID 2084 wrote to memory of 356	2084	rundll32.exe	31
PID 2084 wrote to memory of 356	2084	rundll32.exe	31
PID 2084 wrote to memory of 356	2084	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 224
    3⤵
    - Program crash
    PID:356