284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990

Analysis

max time kernel
131s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:47

Target

$PLUGINSDIR/nsWindows.dll
Size

16KB
MD5

552fff61cb72928253be15861aaffc1d
SHA1

126b2b28958dd38787bc5a564248334c5b89f786
SHA256

e03931b60dfc3fc5a387c037af2f8f04377d73a347f1d1e8f4cc8aad8efca1d1
SHA512

89ccd6fdda7a72f8f74a7ea84a5a15961e9903be7afe6648f4615b26e3231552f75707696e55485740e3fd2a80ffbf66401bc95176f1a313b90d41db63042b5d
SSDEEP

192:fqUyuov2gQWaoJNMSsSCL8XPrw3BOGZnYe+PjPSrcy++v1Etr9ZCspE+TMQrGlmy:fqUyuov2gPriIXPrw3fnYPLltAeMPlf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	4760	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4760	456	rundll32.exe	85
PID 456 wrote to memory of 4760	456	rundll32.exe	85
PID 456 wrote to memory of 4760	456	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWindows.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWindows.dll,#1
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 636
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4760 -ip 4760
1⤵
PID:1680