33ffc220033c7f50c7aa2e00796f62e9e84843972272381546fbe5d8e758e389

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 17:14

Target

$PLUGINSDIR/nsJSON.dll
Size

36KB
MD5

c80631ed154254fcf2d362e532119ab5
SHA1

14104226258dc5b3fc88fd815547c01b1cec2735
SHA256

73698082634a7052fccd9e6ab20a0e9179a4421071e10c0ad53591dfc9ea24aa
SHA512

3d37acefe015e72c82d2e38f155df2a28f84728a5819b518bb3a5b083a6dcee9e227ca423711dd79b5eb9caa34ac6d34bc7d26de3571f0e5ed566d3818e545e1
SSDEEP

768:j1vTYFHvlhqjbm8oEHB6hC+/3P4LA27bRprYiKAMxkE:j1bYPHqu7EUhL27bTr7ox

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2344	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2136 wrote to memory of 2344	2136	rundll32.exe	28
PID 2344 wrote to memory of 2252	2344	rundll32.exe	29
PID 2344 wrote to memory of 2252	2344	rundll32.exe	29
PID 2344 wrote to memory of 2252	2344	rundll32.exe	29
PID 2344 wrote to memory of 2252	2344	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsJSON.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 228
    3⤵
    - Program crash
    PID:2252