b5f9935e0615cfe328feb5a737d7691dd96b202731e0845bdd3226e64ad96123

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 03:34

Target

$PLUGINSDIR/JsisPlugins.dll
Size

2.1MB
MD5

a1336353c555c6fd1832a97ee2268579
SHA1

203b705ef26e1685f2c1613ffa783c1186d64fc6
SHA256

6a6f53c6fcb1f7cd2506c16f318180b748c52f59fb738f2abbebcfe9bf71238d
SHA512

cdab5cdbe7b26de36b379cc71dfaba16004d76ae6d763dd0a86ecd7e57c756d9d8e3610d93edee400fb02b28421b2fdc1047e9b2e3b290e175bd4910e789e27a
SSDEEP

49152:XWUF3+DvlxaVlUj2UxF9TWkWbQWxACvRG+OZ1m/I31he2UaIyuK:XtF3+DLaVlUFWkWbQWx1JtOLm/IgaI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3572 4844 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3572	4844	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2456 wrote to memory of 4844	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 4844	2456	rundll32.exe	rundll32.exe
PID 2456 wrote to memory of 4844	2456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JsisPlugins.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JsisPlugins.dll,#1
2⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 676
3⤵
- Program crash
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4844 -ip 4844
1⤵
PID:1336