Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 20:55
Static task
static1
Behavioral task
behavioral1
Sample
AMENDED CONTRACT-pdf.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
AMENDED CONTRACT-pdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
b5a1f9dc73e2944a388a61411bdd8c70
-
SHA1
dc9b20df3f3810c2e81a0c54dea385704ba8bef7
-
SHA256
288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
-
SHA512
b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
-
SSDEEP
96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2176 2128 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2064 wrote to memory of 2128 2064 rundll32.exe rundll32.exe PID 2128 wrote to memory of 2176 2128 rundll32.exe WerFault.exe PID 2128 wrote to memory of 2176 2128 rundll32.exe WerFault.exe PID 2128 wrote to memory of 2176 2128 rundll32.exe WerFault.exe PID 2128 wrote to memory of 2176 2128 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 2243⤵
- Program crash