435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 08:02

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

d9256d9acaecabb20b7e9a1595abfa36
SHA1

ece1cab181dac7729246da1d4494b8daa10c3b70
SHA256

d7b2c55977a541f8d075e48d4e0a82eec79ad247b0ed168c19a8518131acd19c
SHA512

5827cdbfde0e766d1b74ecb22f9614232031da41c21d0f6ff6c9d5dcdfc0adc23e8fd616eb020ab42208932444b5e0cb1e6d6e698bead412eae19624a180b6ff
SSDEEP

96:oHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4DPqndYHnxss:oHq+CP3uKrpyREs06YxuidGn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4032 5028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4032	5028	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4804 wrote to memory of 5028	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 5028	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 5028	4804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
2⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 636
3⤵
- Program crash
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5028 -ip 5028
1⤵
PID:1908