a64b58872e0a0e0db306c170b1e9a00fcaad67caf18d5e0b52ad13989d1e7186

Analysis

max time kernel
97s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 09:13

Target

$PLUGINSDIR/nsJSON.dll
Size

44KB
MD5

1a8bcfcdd4acb364f9e78d7e5f6e24d2
SHA1

b760838504044ff68516c21bb0f750a930884719
SHA256

29ece51c5d05c280d080dbd0ddb36abbc5b98567bf11e9d94f7c1ab619015eca
SHA512

2abcadb060097b91deb245b2dfa46e792f1e27d1d773c16f2af6e0234c9f03029e3ce2ebc042344c82a9f365f8ae2327e485a64010f6a69cf9c354c8ad5a0191
SSDEEP

768:aoZ1ZnhrTfldqk7Yyy94RxOcVQJrTwEpYiTPxxA4WYidAEPxWEML8:7pi52vOcqlTZ7TPxuP7yEPxU8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	3956	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3956	3784	rundll32.exe	89
PID 3784 wrote to memory of 3956	3784	rundll32.exe	89
PID 3784 wrote to memory of 3956	3784	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 608
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3956 -ip 3956
1⤵
PID:2360