5d8d697707c89466cfe203bde7e242680d020646bd5e49edaabd67fc6a7d6321

Resubmissions

08-05-2024 20:14

08-05-2024 20:11

max time kernel
136s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 20:14

Target

$PLUGINSDIR/nsProcess.dll
Size

15KB
MD5

08072dc900ca0626e8c079b2c5bcfcf3
SHA1

35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA256

bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
SHA512

8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP

192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	752	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 752	64	rundll32.exe	85
PID 64 wrote to memory of 752	64	rundll32.exe	85
PID 64 wrote to memory of 752	64	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
  2⤵
  PID:752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 600
    3⤵
    - Program crash
    PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 752 -ip 752
1⤵
PID:4424