5cbd208cda9350b3ac05a0ac7567e330403376a016e47056a1570ba6e4a483d2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 10:14

Target
$PLUGINSDIR/nsJSON.dll
Size 23KB
Sample240508-l9m6zafd21
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
380	2044	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2044 wrote to memory of 380	2044	rundll32.exe	29
PID 2044 wrote to memory of 380	2044	rundll32.exe	29
PID 2044 wrote to memory of 380	2044	rundll32.exe	29
PID 2044 wrote to memory of 380	2044	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 228
    3⤵
    - Program crash
    PID:380