8df05e255ce1317db4abb9d84c00917f23d3d0ef9ca0bde0cd05e1d7d50efed6

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 06:06

Target

$TEMPfolder/DomriuAdoej/libnspr4.dll
Size

288KB
MD5

74485152d7f2c06fe413f48c7da4ff33
SHA1

a07c30fedc80e5f4c2cc0be5202d64f51b015b44
SHA256

3c019cb209ba4f01015ffbb628d988735d2c5d9805abd7dd4dab441ea82eb688
SHA512

43b3b3bd5d5f3afd845cc79d68e942836f95f708eac96cd84d09b774d8f92f772b2353a273185b6be336603b5b283a486756e95ff26bb1ecd4fe84667cbe6f52
SSDEEP

6144:HkkTJqYJt8dDvEpuzn1IQg5sjvCOODLzvSPIMEuA:H5JqYJadDvEpYE5sjqn7vSPIME

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	3404	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3404	996	rundll32.exe	84
PID 996 wrote to memory of 3404	996	rundll32.exe	84
PID 996 wrote to memory of 3404	996	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\libnspr4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\libnspr4.dll,#1
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 652
    3⤵
    - Program crash
    PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3404 -ip 3404
1⤵
PID:3472