5cfaec15d48d36b15ac725930e3203e30e40bf17fc0d11de83d5e4f42a0f717c

Analysis

max time kernel
94s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:06

Target
$PLUGINSDIR/nsDialogs.dll
Size 11KB
Sample240327-sgspbaef98
SHA256 eac6e063d05453f4917b1f892c864f412d5734e9c01f0b37e62802df0e51bc96
MD5 6e6ea06ff64142decd1544965704b3a3
SHA1 34b3065cdd40d48f4ffaf26b1a35bafefb0bd989
SHA512 7f49c929059bd56c403406e473c5de64b076c1b1011922d4e64967750c1ecdc47c682d68c910744ff6ccf19ed00e3ad55eab5f10775fcbaa08ca3c746e3b15ea
SSDEEP 192:dimuo2iXsGk7lXtUil/HdJZC9jToTlHY0QvKwaHrEmK:sK8zmihi0VYLMHrNK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	2500	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2500	2132	rundll32.exe	85
PID 2132 wrote to memory of 2500	2132	rundll32.exe	85
PID 2132 wrote to memory of 2500	2132	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 636
    3⤵
    - Program crash
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2500 -ip 2500
1⤵
PID:1576

memory/2500-0-0x000000006E940000-0x000000006E94A000-memory.dmp

Download