fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e

Analysis

max time kernel
1563s
max time network
1169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 16:22

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

6c3f8c94d0727894d706940a8a980543
SHA1

0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA256

56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
SHA512

2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP

96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4272 3516 WerFault.exe rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1796 svchost.exe

pid	pid_target	process	target process
4272	3516	WerFault.exe	rundll32.exe

description	pid	process
Token: SeManageVolumePrivilege	1796	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2348 wrote to memory of 3516	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 3516	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 3516	2348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
2⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 636
3⤵
- Program crash
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 3516
1⤵
PID:2608

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796

memory/1796-0-0x000002C004940000-0x000002C004950000-memory.dmp

Filesize
64KB

Download
memory/1796-16-0x000002C004A40000-0x000002C004A50000-memory.dmp

Filesize
64KB

Download
memory/1796-32-0x000002C00CD50000-0x000002C00CD51000-memory.dmp

Filesize
4KB

Download
memory/1796-34-0x000002C00CD80000-0x000002C00CD81000-memory.dmp

Filesize
4KB

Download
memory/1796-35-0x000002C00CD80000-0x000002C00CD81000-memory.dmp

Filesize
4KB

Download
memory/1796-36-0x000002C00CE90000-0x000002C00CE91000-memory.dmp

Filesize
4KB

Download