1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 21:56

Target

$PLUGINSDIR/nsExec.dll
Size

11KB
MD5

d65973e31f6324acfb9669a98fb1d375
SHA1

bde1e7963b46366d186190ba69eb8530ad64572b
SHA256

9e1b4a31bedcbfecbafb4f0b3248bff00f1cc590b03dd41797d5dd39979e27b7
SHA512

29edd129f47174c16ffe964bbd50551c9b7edea038563cda0bdea90229827b23fbe01c765b7c9d2719df4edd58b30755b5d79e9cedc26b43c8833082bfc5c601
SSDEEP

192:QQux93kCB6nGYq1f9ymY1aulOaBETAJYkvQhvLrqVo25JF/:QLx937B6GY48HQulOGETAJYkvGLrEoSD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4736 3456 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4736	3456	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2380 wrote to memory of 3456	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 3456	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 3456	2380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
2⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 612
3⤵
- Program crash
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3456 -ip 3456
1⤵
PID:2700

memory/3456-0-0x0000000074D50000-0x0000000074D59000-memory.dmp

Filesize
36KB

Download