97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 02:29

Target

$PLUGINSDIR/nsDialogs.dll
Size

8KB
MD5

ea9831bdfaa5639bf54de71c6b2d828f
SHA1

2e54592709bdc071d67fbf798681daf58f748e28
SHA256

790a2137bef55443c1b11526cd76110a9d9a352956356b4b254a37ec4d252bbc
SHA512

1adcfcd3fad5e3280175362e9ce8197f7c9a59c5cf9ecd2b526f077eccb623c58e1639c0c520e380944e6913db5b8d23936d5cf76932c6475c1533e4506a9876
SSDEEP

96:N5uaX19Pld1xvNBFzvLnLbCxQPXX56lHpYkU6:NDDjNnzvLn356lJxU6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1736	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1508 wrote to memory of 1736	1508	rundll32.exe	28
PID 1736 wrote to memory of 1648	1736	rundll32.exe	29
PID 1736 wrote to memory of 1648	1736	rundll32.exe	29
PID 1736 wrote to memory of 1648	1736	rundll32.exe	29
PID 1736 wrote to memory of 1648	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 244
    3⤵
    - Program crash
    PID:1648