ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200

Analysis

max time kernel
66s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 15:35

Target

bin/nspr4.dll
Size

155KB
MD5

bd0e897dbc2dcc0cf1287ffd7c734cf0
SHA1

5c9c6c6082127d106520ff2e88d4cd4b665d134f
SHA256

2d2096447b366d6640f2670edb474ab208d8d85b5650db5e80cc985d1189f911
SHA512

db21b151b9877c9b5a5dc2eda3afa6a75a827ce1f340032427b7de1d9f9803767aecc582862b58885f456c78fc75ee529581089b725975600e45c6af785280a9
SSDEEP

3072:5XEjwQq1VzTiey++hdm0mCeZrkAhniYUwl5VFTF0Rda914+2FTTf4oLkPEb:dEMfieU8A2ijMTF0RdE14P5LkP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2000	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 2000	3200	rundll32.exe	84
PID 3200 wrote to memory of 2000	3200	rundll32.exe	84
PID 3200 wrote to memory of 2000	3200	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nspr4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nspr4.dll,#1
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 640
    3⤵
    - Program crash
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2000 -ip 2000
1⤵
PID:4992