090f40c308def8848a645375eeb8758ca9b6796a0b07ad04f38f9f0e7571ad48

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:53

Target

$PLUGINSDIR/FirefoxHandler.dll
Size

42KB
MD5

89299f2e807a795737d82926b076e570
SHA1

ab503dd7ac9028d35a45113fad14ca35b2b0ebd1
SHA256

68b2c80193a1b96c02bd6cf8b30210ed8d8c185855fe99b06ee6d70257e1e58a
SHA512

e8e7bda3f04657e7f36bef52d9d4309d45bb958f5829479ce3f36d39982d9122f9e770c5870301f7e1dc6596d842ed7a2e926a8a77639b213c5ed6e566cb4ecd
SSDEEP

768:g92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZIG6DepE3:82kvkyxkWIF9elU1+ALWOfZZE0E3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2200	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2208 wrote to memory of 2200	2208	rundll32.exe	28
PID 2200 wrote to memory of 2852	2200	rundll32.exe	29
PID 2200 wrote to memory of 2852	2200	rundll32.exe	29
PID 2200 wrote to memory of 2852	2200	rundll32.exe	29
PID 2200 wrote to memory of 2852	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 220
    3⤵
    - Program crash
    PID:2852