25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:23

Target
$PLUGINSDIR/nsDialogs.dll
Size 9KB
Sample240607-brscvsfb4y
SHA256 aedb5122c12037bcf5c79c2197d1474e759cf47c67c37cdb21cf27428854a55b
MD5 d6c3dd680c6467d07d730255d0ee5d87
SHA1 57e7a1d142032652256291b8ed2703b3dc1dfa9b
SHA512 c28613d6d91c1f1f7951116f114da1c49e5f4994c855e522930bb4a8bdd73f12cadf1c6dcb84fc8d9f983ec60a40ac39522d3f86695e17ec88da4bd91c7b6a51
SSDEEP 192:oWa8cSzvTyl4tgi8pPjQM0PuAg0YNyZIFtSP:DaBSzm+t18pZ0WAg0RZIFg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	28
PID 2096 wrote to memory of 2104	2096	rundll32.exe	29
PID 2096 wrote to memory of 2104	2096	rundll32.exe	29
PID 2096 wrote to memory of 2104	2096	rundll32.exe	29
PID 2096 wrote to memory of 2104	2096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 244
    3⤵
    - Program crash
    PID:2104