5c20f787d65581858cad42a613de5ac25c4f08d240d7af4a23bc3769042df3e1

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 15:09

Target

$PLUGINSDIR/nsDialogs.dll
Size

182KB
MD5

b9a5a272154fc0dd652ef9c59c5d63a0
SHA1

a5c72fd5e6080ce7ee8377240f5ced5e908a80af
SHA256

d84d810b8f8819f4a34d5e033b72951eadda1bbb5ed0b8c76874b6c25001caa9
SHA512

1a641c3acb32145431ad51dcbc7bcb5da532ac0fc68ea5b24f588611648dd5cae2bd197c09d5783a03bdcdac73e9ca7b07d646e6fe56903439355cc1fd4007dd
SSDEEP

3072:NEF3K1gSVKhZXpsYOebeCqilqlu7LF6CnsYjXGx52J6RWYbzgt6R1YyAbyLpl:KfOGe5ilUkVjXGs6oizgsPYBmf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	4648	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4648	1948	rundll32.exe	83
PID 1948 wrote to memory of 4648	1948	rundll32.exe	83
PID 1948 wrote to memory of 4648	1948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 656
    3⤵
    - Program crash
    PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4648 -ip 4648
1⤵
PID:3424