051f6581fe2e82e5e0a8c7d387b75aa51911af1560570dca42bb7470d524ad1b

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 15:35

Target

$PLUGINSDIR/nsDialogs.dll
Size

156KB
MD5

879ef35b34de9a94762cb32d26ae0db5
SHA1

a9754a70d9456d7b4292a67d44ccf53757ed70ce
SHA256

51480849fec0b57b872a9bf6992f8c98e6ceb79b318b09a48347f6d3e0bc416f
SHA512

9b373b04fdeef8b9f1cbdd7bf412990422497e437ae6fd0bcbe8ae7f8cf343161f4be200b3207960884c09558175157764f9af688c0cac53119db3ceff980ee2
SSDEEP

3072:DJ3K1vSVKhaXpxVdDRpwSCPRzdcc6rleG5Y0z60g6Z9xl1Wfli8gZC:XVd9gPRzw15Y0Zg6Z9xl1WflCc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	1868	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1868	3868	rundll32.exe	84
PID 3868 wrote to memory of 1868	3868	rundll32.exe	84
PID 3868 wrote to memory of 1868	3868	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:1868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 616
    3⤵
    - Program crash
    PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1868 -ip 1868
1⤵
PID:1692