ee2994270b42614eb65db99369dbe610a5ddaba06322b56c15280d1d5ec76019

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 02:07

Target

$TEMPfolder/ortmp/nssckbi.dll
Size

407KB
MD5

ba406d87af2f892c1b59628899fbcb10
SHA1

6392231726ed0759352c8e11c699a17b2519e528
SHA256

7a5c06a5050881b747eae24e77a4a4ec0f66752c4e0d89e447cded177629965f
SHA512

f2df98b3172eea84a6b2948adf6ff2d48d88f9e393822d776203d5c930628c4b850cb8b92ba60993dec1d25f0e8f6391ca545d2259da1b7a53bece22c7251155
SSDEEP

6144:dJz2s9oBgdMTWfpUwFygo5zUM38MEuL9ewNkUE0kUq:7f9OgWTWfpf0gmzY49zNkUE0kUq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	3432	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3432	940	rundll32.exe	91
PID 940 wrote to memory of 3432	940	rundll32.exe	91
PID 940 wrote to memory of 3432	940	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\nssckbi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\nssckbi.dll,#1
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 644
    3⤵
    - Program crash
    PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3432 -ip 3432
1⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3296