79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21

Analysis

max time kernel
296s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 22:20

Target

$PLUGINSDIR/nsDialogs.dll
Size

14KB
MD5

494c8f9c6a5fc302e8b50f05ef9aeb8c
SHA1

75fe258210f0989a7afaecd42e45841d076dc8b8
SHA256

e9ab864697d454cd4a85abf38ec4236ee56ddd0c59f9422ae1e774b9487f132d
SHA512

363780eeded89bd720addb11ef42893d13852fe1c446305cbda73cf994da6848338458f2da4eafa42857533e6fc30e24f6db3b36df5f7cc51b9307010ddfa401
SSDEEP

384:DqWL5JCYXh2OPxv9OIR6oYkvLlAPPPbgS+dXA2N:DqXG2cLR9v2gBnN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2944	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2792 wrote to memory of 2944	2792	rundll32.exe	28
PID 2944 wrote to memory of 3004	2944	rundll32.exe	29
PID 2944 wrote to memory of 3004	2944	rundll32.exe	29
PID 2944 wrote to memory of 3004	2944	rundll32.exe	29
PID 2944 wrote to memory of 3004	2944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 244
    3⤵
    - Program crash
    PID:3004

memory/2944-0-0x0000000074FB0000-0x0000000074FBC000-memory.dmp

Filesize
48KB

Download