a64b58872e0a0e0db306c170b1e9a00fcaad67caf18d5e0b52ad13989d1e7186

Analysis

max time kernel
95s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 09:13

Target

$PLUGINSDIR/nsProcess.dll
Size

25KB
MD5

92e43d9e657a2366b412475683ad7b07
SHA1

9de0cd039d79bf90a407a09b283ecff5b511bd98
SHA256

1093622ea8e01f5614f343603d8c622193eafa5b35773e5bd2c2dc0911f22a48
SHA512

591d4bb819d5b8622dcc2be75ee78c25ac84da843a5cb6270046ad427f38e97e619dc5726a3aef2d3c202990d5ddc0bf1af1e7e7436ca3b18377871616e49181
SSDEEP

384:BZheNyb8E9VF6IYiTPxgGnAeHzPEZRbjUfIYiMGnAeHzPqXHQssPxh8E9VF0Nyp3:B3mEpYiTPxxATbXYidAXHGPxWE33

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	3616	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 3616	5236	rundll32.exe	84
PID 5236 wrote to memory of 3616	5236	rundll32.exe	84
PID 5236 wrote to memory of 3616	5236	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
  2⤵
  PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 600
    3⤵
    - Program crash
    PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3616 -ip 3616
1⤵
PID:4692