f02074eeb1cba11ac24a507940543b0ffb18121b7a23a556bfb53e0c74a8fc84

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 08:47

Target
$PLUGINSDIR/nsBrowserOpt.dll
Size 315KB
Sample240415-kp2cesda2v
SHA256 6dee4487d5ffb10ada3cb4e4f8124ac445870cf38e3eb0df0be1ec1d9088267e
MD5 716f84312a370cbb59e89770016ac76d
SHA1 c804e0c5471e63071d4b480d53cc8faf333b9984
SHA512 2bf06e57edaa7c41466c2c3aebfdde097b376bfc13b214f5e90b2770e9756cb249f8e1978b92cf3b32cfede68b8b234537aea84d8c270e3222311cf6358ae975
SSDEEP 6144:6creMAt6kGYFZFsgNsYXnzI0LdG91TBLMZk4C/L:62eMA8XYdhNsY3zIKg1TRMZktL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28
PID 1048 wrote to memory of 2972	1048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsBrowserOpt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsBrowserOpt.dll,#1
  2⤵
  PID:2972