1234fca475092501d14959a1150d53c1817759cfb3960376640065467590cd66

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 07:38

Target

$PLUGINSDIR/FirefoxHandler.dll
Size

36KB
MD5

297f686666aab3309cabc430199dfd10
SHA1

0e57ded3db82a5c6de284a6fa93cc38bb8834ac9
SHA256

6eef17cfaa4e4420f41a5e80c2fc49f4c1b8e44c8b648982c5cf5311fbd91dca
SHA512

39ba6a6523df27c9e4e5d764a6ddde8129bbf80800b4b660354307d2601e84ed0783a6c035c5c1411a12177f95617db43d7ae2f3b0a2f5389d4d2681276196ac
SSDEEP

768:J92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZI:X2kvkyxkWIF9elU1+ALWOfZZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

312 2280 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2280 rundll32.exe

pid	pid_target	process	target process
312	2280	WerFault.exe	rundll32.exe

pid	process
2280	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 1244 wrote to memory of 2280	1244	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe
PID 2280 wrote to memory of 312	2280	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 220
3⤵
- Program crash
PID:312