59ebf7abfd6a8426a17243702c28a7e548c45faf7bc360d6396aca1b9e666b54

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 11:01

Target

$PLUGINSDIR/nsWebJPDesk.dll
Size

300KB
MD5

483486795b59acf40856efc793bb928b
SHA1

3bf1f3ae90123f0f83d74137e075e756c3f84032
SHA256

3628c8c424b121b6d1604630083dd8fcf9d4886e34a045ab7e8c7e5733ca7ab9
SHA512

fbddfa5a3d9bf74d180167a7a2b7de877b2f1df8f75aeacbb98f8b2d28ba334d33605299682736ae77ed180ba66ede20e2f5b9c74edf5512fadbe6ecb582511c
SSDEEP

3072:BL3y69Ug710uiAe8afyMlqQkkc6ncSQ9vyw8gekwvegplJwwwwww6pZaELk5+C:BL3dUW1X2lqdKcS0Hwjl2Jw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	5056	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 5056	4548	rundll32.exe	89
PID 4548 wrote to memory of 5056	4548	rundll32.exe	89
PID 4548 wrote to memory of 5056	4548	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 668
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4164,i,18261153038209191383,10347744459236715365,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
1⤵
PID:1240