e42af5bffa231ebbc62fea3befe73570c5f428a2c77f7fc33b72c31ef8b6245f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:55

Target

$PLUGINSDIR/nsExec.dll
Size

7KB
MD5

b4579bc396ace8cafd9e825ff63fe244
SHA1

32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA256

01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
SHA512

3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
SSDEEP

96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2796 2552 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2796	2552	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2912 wrote to memory of 2552	2912	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2796	2552	rundll32.exe	WerFault.exe
PID 2552 wrote to memory of 2796	2552	rundll32.exe	WerFault.exe
PID 2552 wrote to memory of 2796	2552	rundll32.exe	WerFault.exe
PID 2552 wrote to memory of 2796	2552	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 220
3⤵
- Program crash
PID:2796