221b160532a8bd6357a78ab2dadbfb74a9101c030362ea6b5e1a06a7a38f4efc

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 21:00

Target

$PLUGINSDIR/FirefoxHandler.dll
Size

36KB
MD5

297f686666aab3309cabc430199dfd10
SHA1

0e57ded3db82a5c6de284a6fa93cc38bb8834ac9
SHA256

6eef17cfaa4e4420f41a5e80c2fc49f4c1b8e44c8b648982c5cf5311fbd91dca
SHA512

39ba6a6523df27c9e4e5d764a6ddde8129bbf80800b4b660354307d2601e84ed0783a6c035c5c1411a12177f95617db43d7ae2f3b0a2f5389d4d2681276196ac
SSDEEP

768:J92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZI:X2kvkyxkWIF9elU1+ALWOfZZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	2924	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	rundll32.exe
2924	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2924	2388	rundll32.exe	84
PID 2388 wrote to memory of 2924	2388	rundll32.exe	84
PID 2388 wrote to memory of 2924	2388	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 620
    3⤵
    - Program crash
    PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2924 -ip 2924
1⤵
PID:2096