47ffb920fceccd76781e0b05fdf7782bd79077966935cefa93ecaba606217fea

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 08:52

Target

$PLUGINSDIR/nsBrowserOpt.dll
Size

357KB
MD5

24f6bd871e1e2970b0103409a1353743
SHA1

fe694649a60d9cfa7556bf97fb552763d72edb2f
SHA256

255f6485877b34f24b7d52847cdaa519385ddaf0d6e5e433d2331133bea55b90
SHA512

518a4274a35c1b68751801b9cccfd9cfdcc72a98fb0ea5e1411cb703c3cb7bfc8f99577e4e75aed7ca8996d19a8bedaa4fac30651c82a965b39697ee194c315a
SSDEEP

6144:lVPt3f0o84MQ9TvAalLw4Qqh+rgsg1FGUjPWeyk7MtRa3TByd4kDbpsmEGf47:lVPRso84MQdAalLwtVrgsg1FGleyk7MC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2248	3596	rundll32.exe	83
PID 3596 wrote to memory of 2248	3596	rundll32.exe	83
PID 3596 wrote to memory of 2248	3596	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsBrowserOpt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsBrowserOpt.dll,#1
  2⤵
  PID:2248