f1c9f555e256436bdf0646e341815893d6e7dff068671ff17212fc5cb983f89d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 08:16

Target

$PLUGINSDIR/nshist.dll
Size

39KB
MD5

d3686f7113ae84568624746249cbec6e
SHA1

a5849fd8e5722f91e58eec28244e9d54387f5912
SHA256

0d8fc9dc3894ccab669eee7e07c7d53a85ee191069c5e02140a23bc19461ec39
SHA512

18dec8ef52c343587e7790bbb4a0eca9a02efd37ca347e2ed72d03c2021486b240c8d451c2d04e1b564c80eee437b4730d53c7702524159291255a15e6de1b6d
SSDEEP

384:R+e5X+ZjXEP40ozKzdp1L99uwvwXjnxsEVxBCcN7avJtgJ4lxFZZQRiMC3vQQnoz:1cIQk9R9uwvwXdsQxJN+vG4BZIlQG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	3940	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3940	3848	rundll32.exe	84
PID 3848 wrote to memory of 3940	3848	rundll32.exe	84
PID 3848 wrote to memory of 3940	3848	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nshist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nshist.dll,#1
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 620
    3⤵
    - Program crash
    PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3940 -ip 3940
1⤵
PID:2376