343bcf3e6a6cfb2ba9011c8cb5215b4fe5c2f515734bef0979ee3d1de3c6e202

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 21:46

Target

$PLUGINSDIR/nsDialogs.dll
Size

156KB
MD5

879ef35b34de9a94762cb32d26ae0db5
SHA1

a9754a70d9456d7b4292a67d44ccf53757ed70ce
SHA256

51480849fec0b57b872a9bf6992f8c98e6ceb79b318b09a48347f6d3e0bc416f
SHA512

9b373b04fdeef8b9f1cbdd7bf412990422497e437ae6fd0bcbe8ae7f8cf343161f4be200b3207960884c09558175157764f9af688c0cac53119db3ceff980ee2
SSDEEP

3072:DJ3K1vSVKhaXpxVdDRpwSCPRzdcc6rleG5Y0z60g6Z9xl1Wfli8gZC:XVd9gPRzw15Y0Zg6Z9xl1WflCc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	3060	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 1448 wrote to memory of 3060	1448	rundll32.exe	28
PID 3060 wrote to memory of 1592	3060	rundll32.exe	29
PID 3060 wrote to memory of 1592	3060	rundll32.exe	29
PID 3060 wrote to memory of 1592	3060	rundll32.exe	29
PID 3060 wrote to memory of 1592	3060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 256
    3⤵
    - Program crash
    PID:1592