2ff2ba5b37acf3f129832c9f1ceacc6c6148ed71726bc4e262d829ee80430192

Analysis

max time kernel
164s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 20:22

Target

$PLUGINSDIR/nsArray.dll
Size

6KB
MD5

82d49c227928741f6f09c5cea3bde9f1
SHA1

b0904368a5e94026d0ca5760d4577236f796051d
SHA256

8bc5e75bbfa5a8f10526aec2af441153b2883d6d288726ed8f7c9af12a1ee02b
SHA512

d4f588e3613886e3dab58330cd69ce7f24c39be2c4854cc8edfcef98e1324926fcde0d79df1a8fdf5e2bf9327b17f22a9fa1396568c0ace4e46d4f548fdc7530
SSDEEP

192:mUODeqedh6EHFRA5sX7d7KnnpOKxX22v:2qqedh6EHFRksp7KpFX

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral32/memory/780-0-0x0000000075330000-0x000000007533A000-memory.dmp	upx
behavioral32/memory/780-1-0x0000000075330000-0x000000007533A000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4820	780	WerFault.exe	97
4008	780	WerFault.exe	97

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 780	764	rundll32.exe	97
PID 764 wrote to memory of 780	764	rundll32.exe	97
PID 764 wrote to memory of 780	764	rundll32.exe	97
PID 780 wrote to memory of 4820	780	rundll32.exe	104
PID 780 wrote to memory of 4820	780	rundll32.exe	104
PID 780 wrote to memory of 4820	780	rundll32.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsArray.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsArray.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 600
    3⤵
    - Program crash
    PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 600
    3⤵
    - Program crash
    PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 780 -ip 780
1⤵
PID:4044

memory/780-0-0x0000000075330000-0x000000007533A000-memory.dmp

Filesize
40KB

Download
memory/780-1-0x0000000075330000-0x000000007533A000-memory.dmp

Filesize
40KB

Download