01e8b6a66c844769dd5d595dff576f972fb7a70ce4e19474f30ca66ee018b960

Analysis

max time kernel
55s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 11:07

Target

$TEMPfolder/FonbOmacd/libnspr4.dll
Size

288KB
MD5

74485152d7f2c06fe413f48c7da4ff33
SHA1

a07c30fedc80e5f4c2cc0be5202d64f51b015b44
SHA256

3c019cb209ba4f01015ffbb628d988735d2c5d9805abd7dd4dab441ea82eb688
SHA512

43b3b3bd5d5f3afd845cc79d68e942836f95f708eac96cd84d09b774d8f92f772b2353a273185b6be336603b5b283a486756e95ff26bb1ecd4fe84667cbe6f52
SSDEEP

6144:HkkTJqYJt8dDvEpuzn1IQg5sjvCOODLzvSPIMEuA:H5JqYJadDvEpYE5sjqn7vSPIME

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4732 4524 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4732	4524	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 4524	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 4524	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 4524	1692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\FonbOmacd\libnspr4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\FonbOmacd\libnspr4.dll,#1
2⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 644
3⤵
- Program crash
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4524 -ip 4524
1⤵
PID:4924