01112ca4e7b63cf359d1264d40679b3a85fae1f1aa6a04f29a49c2b3cdc5c25f

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:16

Target

$PLUGINSDIR/nsJSON.dll
Size

7KB
MD5

1273161f8a69272e44ceb109d8d447b9
SHA1

a330d1ddbaac74fba14de9435e4156a4a364d7d7
SHA256

b6d7cf201bddd18a999936e46f9803fab95a9c0ff97f32bbe8418b970944f0f0
SHA512

4f0026f2fe8355809719b7506ae6fcbe65f853b7416cfb29d5abe30b05f134ce2d9208f515899bee73e00cb8b2c21d7048c11aa76e5cf13491ccfcf8884f7ccb
SSDEEP

96:oitGZO0ajss18LYyUCMGHdgna94I9TTGgK7QFxtqLFmrLB3qrNM0r7fGnrnqJR:oitGZO0aI2yYyt5Aa94eKmt+aON7Gr

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral7/memory/2024-1-0x0000000075240000-0x000000007524B000-memory.dmp	upx
behavioral7/memory/2024-3-0x0000000075240000-0x000000007524B000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2496 2024 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2496	2024	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 2024	3012	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2496	2024	rundll32.exe	WerFault.exe
PID 2024 wrote to memory of 2496	2024	rundll32.exe	WerFault.exe
PID 2024 wrote to memory of 2496	2024	rundll32.exe	WerFault.exe
PID 2024 wrote to memory of 2496	2024	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 224
    3⤵
    - Program crash
    PID:2496

memory/2024-2-0x0000000075250000-0x000000007525B000-memory.dmp

Filesize
44KB

Download
memory/2024-1-0x0000000075240000-0x000000007524B000-memory.dmp

Filesize
44KB

Download
memory/2024-0-0x0000000075250000-0x000000007525B000-memory.dmp

Filesize
44KB

Download
memory/2024-3-0x0000000075240000-0x000000007524B000-memory.dmp

Filesize
44KB

Download
memory/2024-5-0x0000000075250000-0x000000007525B000-memory.dmp

Filesize
44KB

Download
memory/2024-6-0x0000000075250000-0x000000007525B000-memory.dmp

Filesize
44KB

Download