f23044e2fd0574d7ec3d9e4674f916e0345088fa0d4ba7987d39284e3b858454

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 09:09

Target

$PLUGINSDIR/nsDui.dll
Size

5.8MB
MD5

cc7a39474889f5c2f7a356ffdc379e84
SHA1

70ed8bb13800c0caa9428ad27da34dbf817b7102
SHA256

ce70c1e7ebd8d0faf8691a9d585c8947528d390bf1d847dff79f5aae5c0e0f09
SHA512

3ec15aa68d0c45c8a22a5b9366a210ae8031ee7b7543c66b3226c716cc8317a898bae0cb9ac01e162a2db6979cd7fc63fdc3008e8a00819f84f7a6a2e75074df
SSDEEP

98304:TqD/IiTz+xbDcc0Wc9dOJxYKmSAWjOcsyxKwOj0jRHKmSAW0OW4JXlVgFKzpxdB9:TYLOxhg9dOJBFFOjwOj3FmOXPV5prBB7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	2496	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2496	3860	rundll32.exe	83
PID 3860 wrote to memory of 2496	3860	rundll32.exe	83
PID 3860 wrote to memory of 2496	3860	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDui.dll,#1
  2⤵
  PID:2496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 688
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2496 -ip 2496
1⤵
PID:2616