c7c1e87f74a0a769fed8b305ce43f926bd68e02e80f40976698366baa045b0cf

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 06:58

Target

$PLUGINSDIR/nsDialogs.dll
Size

14KB
MD5

3122c5948b4ea998bca7765b1d631339
SHA1

31f152b86e9f1fcbe91059bd5962d4ffd8b35f02
SHA256

2107b714dadbd411e2e11126f350f744c20bc095cf22069b43b50cf2fa00cdf9
SHA512

6f9806b9fa76a08be66d31898c0fe40fc311b8d3d241ae7b47ed5dcc48e2f39b4c274791f9874603e5aaa1a07adc21b99ae20cd4a1dcb94dcaddd929ba0eb0a6
SSDEEP

192:LOrKRV2z1BM6CVqBdjtuL+pqxtZO+5KXW7VQ4zZblxw2azX8oRdeqe4B0:6rKRj6CVqBhtuCmtX5KGbl2RAl4m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 168
  2⤵
  PID:2212

memory/2368-0-0x000007FEFB970000-0x000007FEFB97D000-memory.dmp

Filesize
52KB

Download