d4c3919ec72842ee308477798826f76fec77e2f20e862750b7cf542b385b0433

Analysis

max time kernel
78s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 12:22

Target

$PLUGINSDIR/FirefoxHandler.dll
Size

42KB
MD5

89299f2e807a795737d82926b076e570
SHA1

ab503dd7ac9028d35a45113fad14ca35b2b0ebd1
SHA256

68b2c80193a1b96c02bd6cf8b30210ed8d8c185855fe99b06ee6d70257e1e58a
SHA512

e8e7bda3f04657e7f36bef52d9d4309d45bb958f5829479ce3f36d39982d9122f9e770c5870301f7e1dc6596d842ed7a2e926a8a77639b213c5ed6e566cb4ecd
SSDEEP

768:g92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZIG6DepE3:82kvkyxkWIF9elU1+ALWOfZZE0E3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	4948	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	rundll32.exe
4948	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4948	1940	rundll32.exe	87
PID 1940 wrote to memory of 4948	1940	rundll32.exe	87
PID 1940 wrote to memory of 4948	1940	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FirefoxHandler.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 616
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4948 -ip 4948
1⤵
PID:4084