1234fca475092501d14959a1150d53c1817759cfb3960376640065467590cd66

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 07:38

Target

$PLUGINSDIR/FirefoxHandler.dll
Size

36KB
MD5

297f686666aab3309cabc430199dfd10
SHA1

0e57ded3db82a5c6de284a6fa93cc38bb8834ac9
SHA256

6eef17cfaa4e4420f41a5e80c2fc49f4c1b8e44c8b648982c5cf5311fbd91dca
SHA512

39ba6a6523df27c9e4e5d764a6ddde8129bbf80800b4b660354307d2601e84ed0783a6c035c5c1411a12177f95617db43d7ae2f3b0a2f5389d4d2681276196ac
SSDEEP

768:J92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZI:X2kvkyxkWIF9elU1+ALWOfZZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

880 2136 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2136 rundll32.exe
2136 rundll32.exe

pid	pid_target	process	target process
880	2136	WerFault.exe	rundll32.exe

pid	process
2136	rundll32.exe
2136	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2320 wrote to memory of 2136	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 2136	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 2136	2320	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 616
3⤵
- Program crash
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2136 -ip 2136
1⤵
PID:3444