bf0251e3e76a263068db92373e19bd646c695f75f5100799c569c76dd92c0c8b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 11:05

Target

$PLUGINSDIR/nsURL.dll
Size

276KB
MD5

00041c73dc322c96c1a128883ee2e249
SHA1

c13f7beb0a7c8da10d2e624fea642909d0fb15aa
SHA256

24d6944b630376e25cba2ff64b007d37b519699d18d77e0f01412c7d3a9aa9bf
SHA512

fe3e7cc71a8f2b74b7ed311ee138b1d3f2ac5c60bc6a647bee515ec9ee9f9ae635d1431dc5b963ffffaf8c54d70ee99c47a162f70aa14e45cd62f1cecabd8af7
SSDEEP

3072:oEAnycL2sxEpaZMpJuJKV4j/ILvJAL4+y4FUYcexRbO4/Fg:oEAycL/xTMewsMgykP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	348	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 1796 wrote to memory of 348	1796	rundll32.exe	28
PID 348 wrote to memory of 2380	348	rundll32.exe	29
PID 348 wrote to memory of 2380	348	rundll32.exe	29
PID 348 wrote to memory of 2380	348	rundll32.exe	29
PID 348 wrote to memory of 2380	348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 228
    3⤵
    - Program crash
    PID:2380