8df05e255ce1317db4abb9d84c00917f23d3d0ef9ca0bde0cd05e1d7d50efed6

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 06:06

Target

$TEMPfolder/DomriuAdoej/nssckbi.dll
Size

407KB
MD5

ba406d87af2f892c1b59628899fbcb10
SHA1

6392231726ed0759352c8e11c699a17b2519e528
SHA256

7a5c06a5050881b747eae24e77a4a4ec0f66752c4e0d89e447cded177629965f
SHA512

f2df98b3172eea84a6b2948adf6ff2d48d88f9e393822d776203d5c930628c4b850cb8b92ba60993dec1d25f0e8f6391ca545d2259da1b7a53bece22c7251155
SSDEEP

6144:dJz2s9oBgdMTWfpUwFygo5zUM38MEuL9ewNkUE0kUq:7f9OgWTWfpf0gmzY49zNkUE0kUq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4340	3624	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3624	3016	rundll32.exe	82
PID 3016 wrote to memory of 3624	3016	rundll32.exe	82
PID 3016 wrote to memory of 3624	3016	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\nssckbi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\DomriuAdoej\nssckbi.dll,#1
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 644
    3⤵
    - Program crash
    PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3624 -ip 3624
1⤵
PID:4680