f1c9f555e256436bdf0646e341815893d6e7dff068671ff17212fc5cb983f89d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:16

Target

$PLUGINSDIR/nshist.dll
Size

39KB
MD5

d3686f7113ae84568624746249cbec6e
SHA1

a5849fd8e5722f91e58eec28244e9d54387f5912
SHA256

0d8fc9dc3894ccab669eee7e07c7d53a85ee191069c5e02140a23bc19461ec39
SHA512

18dec8ef52c343587e7790bbb4a0eca9a02efd37ca347e2ed72d03c2021486b240c8d451c2d04e1b564c80eee437b4730d53c7702524159291255a15e6de1b6d
SSDEEP

384:R+e5X+ZjXEP40ozKzdp1L99uwvwXjnxsEVxBCcN7avJtgJ4lxFZZQRiMC3vQQnoz:1cIQk9R9uwvwXdsQxJN+vG4BZIlQG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	1792	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 2448 wrote to memory of 1792	2448	rundll32.exe	30
PID 1792 wrote to memory of 3028	1792	rundll32.exe	31
PID 1792 wrote to memory of 3028	1792	rundll32.exe	31
PID 1792 wrote to memory of 3028	1792	rundll32.exe	31
PID 1792 wrote to memory of 3028	1792	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nshist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nshist.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 232
    3⤵
    - Program crash
    PID:3028