3c0321082e2c4e2fae6e469c2c1d6af4e79fb909338da35018fef08cc32bbd0b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 12:07

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

b0165587c54350b6c9910e765f16ad9e
SHA1

fd81de9f3b1dd8d6cfa8621fddf9f93c29b4710f
SHA256

26006c739057373f948b11892f40b0cc686c6c97c448f79447856421f9a15563
SHA512

2f69354fd433eec277a804124f5c476fd645270b89af3db22ed45b599cdf251cfccdc3c642b8893078748a0a674676ea28c5fe5b471a633de7301c6a6646295b
SSDEEP

192:bzQhZDqlJcKISw99ioU3MSfwLF/+nhHUOFsdz:bzoZDGKYw9goWyFGBUVz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	760	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 1972 wrote to memory of 760	1972	rundll32.exe	28
PID 760 wrote to memory of 2216	760	rundll32.exe	29
PID 760 wrote to memory of 2216	760	rundll32.exe	29
PID 760 wrote to memory of 2216	760	rundll32.exe	29
PID 760 wrote to memory of 2216	760	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 244
    3⤵
    - Program crash
    PID:2216