8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
199s
max time network
315s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 19:36

Target

$PLUGINSDIR/nsRichEdit.dll
Size

5KB
MD5

e81c4534fc882032078b39a01eece599
SHA1

4afd2f33f97ddd825ae0d7e22ad10e15854c093e
SHA256

add71c2a8ea08ca5a9ef7eb9e725443ae64939f7db0ad80e8adfb89267feb72b
SHA512

73874d23ff9c2eb573e961e730f17ba804734d79059d0b42c141be11c4cb923b9e377c4b17717e3acbfa00d0f3ba85d5addf933b54747b4b08434de956dc1f60
SSDEEP

96:ubs6zRonEMjZERSXL87ceU6AhOhB7lkZ3hBjB6wZ:azhMJLheUf+ZkZX

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral12/memory/4296-0-0x0000000075510000-0x0000000075519000-memory.dmp	acprotect
behavioral12/memory/4296-1-0x0000000075510000-0x0000000075519000-memory.dmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral12/memory/4296-0-0x0000000075510000-0x0000000075519000-memory.dmp	upx
behavioral12/memory/4296-1-0x0000000075510000-0x0000000075519000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3192	4296	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4296	1020	rundll32.exe	79
PID 1020 wrote to memory of 4296	1020	rundll32.exe	79
PID 1020 wrote to memory of 4296	1020	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsRichEdit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsRichEdit.dll,#1
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 540
    3⤵
    - Program crash
    PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4296 -ip 4296
1⤵
PID:2272

memory/4296-0-0x0000000075510000-0x0000000075519000-memory.dmp

Filesize
36KB

Download
memory/4296-1-0x0000000075510000-0x0000000075519000-memory.dmp

Filesize
36KB

Download