4b6cc676769de04acf4936a5a395349cb779616c0621c5921bf07c3e405b51ee

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2024, 13:41

Sharing

Target

$PLUGINSDIR/JsisPlugins.dll
Size

2.1MB
MD5

04091b9dc274a8aeceaa250d9d5aed4e
SHA1

39a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256

dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA512

7b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
SSDEEP

49152:tdvRIHldYQpQzyXT0MY73AHbmPTX2AuchZyE1F4iqA9AfzqteB849r:t7IHlrptXTnbmPTX2AuchZp1F4Djzqt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	4068	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4068	4984	rundll32.exe	81
PID 4984 wrote to memory of 4068	4984	rundll32.exe	81
PID 4984 wrote to memory of 4068	4984	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JsisPlugins.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JsisPlugins.dll,#1
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 592
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 4068
1⤵
PID:716