7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:15

Target

$PLUGINSDIR/nsProcess.dll
Size

15KB
MD5

08072dc900ca0626e8c079b2c5bcfcf3
SHA1

35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA256

bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
SHA512

8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP

192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2272 1624 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2272	1624	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 1624	2724	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 2272	1624	rundll32.exe	WerFault.exe
PID 1624 wrote to memory of 2272	1624	rundll32.exe	WerFault.exe
PID 1624 wrote to memory of 2272	1624	rundll32.exe	WerFault.exe
PID 1624 wrote to memory of 2272	1624	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 228
    3⤵
    - Program crash
    PID:2272