df24ac6bf997b6f86668a75aba8b33e8c9d585382c0404c74232558684305caf

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 08:22

Target

$PLUGINSDIR/nsWebJPDesk.dll
Size

301KB
MD5

b50425b99af3f069fc066dd140d25475
SHA1

f8884cfa2c2cdea217be5b4cd8990500d88ae45c
SHA256

4a5b81912822243066b88530f07335a4c5b9d6c8ea5a1a656d42561a24275ad9
SHA512

fda752bb1cf08345403316d9c42211ad6400bd544c214d087be744ee28709be14d88ccb70090213cbe0b893fa0b51ffa1123f7eda0185c3cd74e8664612afe77
SSDEEP

3072:r4Y/2U+BvoH1GDxy6R+UIqQkkc6ncSQ9vyw8gekwvegplJwwwwww6pZaELk5O:r4m+va1nmIqdKcS0Hwjl2Jw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
348	3116	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81
PID 380 wrote to memory of 3116	380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 668
    3⤵
    - Program crash
    PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3116 -ip 3116
1⤵
PID:1572