7f8ee260f5a6650c42992b658403c6db98fac6d3e552da6bef23a6a691e4bb9e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 01:58

Target

$PLUGINSDIR/nsURL.dll
Size

130KB
MD5

8cfcad073ee407ed9d347e66ede2b0e5
SHA1

8ff0e4acb5eaff7dcef517bbc06f5514ce037b3a
SHA256

73be46ee304981b7e5f9ece3a0222b4c53717450b630a70c997d2d63bced9ac1
SHA512

d86176791f0e5f7b047add20a7c9ce03ddc881819055cc6ae98d113707b89a19ca1f7637cf2a2cc6ffdaf794b673f13a6ac933212794e5ff6c32d28b18e360ca
SSDEEP

1536:SgfY4mHSF6+WGqp38Dvy4GBG7Xr0suPLHqnmW9mz7xKz+ToncPZsWjcdmwyhkqM5:TJlpDD0e2r24xW+som/ldz7+a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	2676	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 1732 wrote to memory of 2676	1732	rundll32.exe	28
PID 2676 wrote to memory of 2480	2676	rundll32.exe	29
PID 2676 wrote to memory of 2480	2676	rundll32.exe	29
PID 2676 wrote to memory of 2480	2676	rundll32.exe	29
PID 2676 wrote to memory of 2480	2676	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 228
    3⤵
    - Program crash
    PID:2480