1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 21:56

Target

$PLUGINSDIR/nsExec.dll
Size

11KB
MD5

d65973e31f6324acfb9669a98fb1d375
SHA1

bde1e7963b46366d186190ba69eb8530ad64572b
SHA256

9e1b4a31bedcbfecbafb4f0b3248bff00f1cc590b03dd41797d5dd39979e27b7
SHA512

29edd129f47174c16ffe964bbd50551c9b7edea038563cda0bdea90229827b23fbe01c765b7c9d2719df4edd58b30755b5d79e9cedc26b43c8833082bfc5c601
SSDEEP

192:QQux93kCB6nGYq1f9ymY1aulOaBETAJYkvQhvLrqVo25JF/:QLx937B6GY48HQulOGETAJYkvGLrEoSD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 1032 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2264	1032	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 1032	2456	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 2264	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 2264	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 2264	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 2264	1032	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 220
3⤵
- Program crash
PID:2264

memory/1032-0-0x00000000752E0000-0x00000000752E9000-memory.dmp

Filesize
36KB

Download