e04d1e223f771a9d89e675815914be8dbf70343c6679f5602469698f44779b03

Analysis

max time kernel
157s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 18:32

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

f8d73e6c35f053856e23146405550b37
SHA1

88ca02327f3c421e8eea9ce4044c669ddb09c937
SHA256

26e774dd67c362992bb2412be34c27b5e6dd0a24ef7f274f598c7d6cb2a658d1
SHA512

1b019a2e426b8dc509813d9d5489162a2933e9bac97e6b4956792466a21e6f146ec0c7d5108db1c827c24bc0a84d761b40098d7cf1de6f11452b7585002adce7
SSDEEP

96:az20b56S03smw/SK5bUhkRuiKkwhJkEIGEoOcxzKMyB0r53HdYnndXxV:n/Syw/SDViKkWJhEoOd0r539Gn1/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	4284	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4284	1760	rundll32.exe	88
PID 1760 wrote to memory of 4284	1760	rundll32.exe	88
PID 1760 wrote to memory of 4284	1760	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 636
    3⤵
    - Program crash
    PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4284 -ip 4284
1⤵
PID:4448