16ee7e004bd4f9ec334884b9e630378eb14f301ac56ed922f986cec31ce95823

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 03:00

Target

$R2/nspr4.dll
Size

260KB
MD5

68328b747cc7e2dc96e4e39c1cbbde08
SHA1

d1a049f9abc50b334ad94556f293ac0148de6408
SHA256

7c2950f81ff490d45e063236c2797f1dc6833681e34f9e379fc2c2687b63a500
SHA512

ce3eb2989d183e56e1ed346eac01b70cbecadddf08653f9e3687564df5f6b75995e8258fae2481a5c8498914c8e24fe769b90230593f898ca3e1fcf0eae6430d
SSDEEP

3072:eVBvCEfCCwRBy5kYZBLzuvvG29RqwP+5fEPaFSEW0beHpTIBVagk2v6lGw2V9hOn:eLvZfGy5kAOx2SEW04WBhAlb2VU28vu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4236	2100	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2100	2240	rundll32.exe	90
PID 2240 wrote to memory of 2100	2240	rundll32.exe	90
PID 2240 wrote to memory of 2100	2240	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\nspr4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\nspr4.dll,#1
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 640
    3⤵
    - Program crash
    PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2100 -ip 2100
1⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2364