7f8ee260f5a6650c42992b658403c6db98fac6d3e552da6bef23a6a691e4bb9e

Analysis

max time kernel
52s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 01:58

Target

$PLUGINSDIR/nsURL.dll
Size

130KB
MD5

8cfcad073ee407ed9d347e66ede2b0e5
SHA1

8ff0e4acb5eaff7dcef517bbc06f5514ce037b3a
SHA256

73be46ee304981b7e5f9ece3a0222b4c53717450b630a70c997d2d63bced9ac1
SHA512

d86176791f0e5f7b047add20a7c9ce03ddc881819055cc6ae98d113707b89a19ca1f7637cf2a2cc6ffdaf794b673f13a6ac933212794e5ff6c32d28b18e360ca
SSDEEP

1536:SgfY4mHSF6+WGqp38Dvy4GBG7Xr0suPLHqnmW9mz7xKz+ToncPZsWjcdmwyhkqM5:TJlpDD0e2r24xW+som/ldz7+a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	5060	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5060	4732	rundll32.exe	81
PID 4732 wrote to memory of 5060	4732	rundll32.exe	81
PID 4732 wrote to memory of 5060	4732	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 608
    3⤵
    - Program crash
    PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
1⤵
PID:1332