879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 00:30

Target

$PLUGINSDIR/nsDialogs.dll
Size

15KB
MD5

8cd70f1945da79795ff2efabecbad6c6
SHA1

47ce283d49703babd6c54465937ccef75c8a74cd
SHA256

9f95e57131a751dd802389271af6dd673ed68345024f09037835e3aacd46cd62
SHA512

6b620f86d24516dcc2da142ee79b630d7fccdebaddeee1adda58a5fadd7174d72a6bcb0777d63e3cf571ae4d1d94088cc007213b3f75755b8fd97a383dde7dc6
SSDEEP

384:8A7k8985U30WAw0hGIFc5f4c8ZpH3GCJEAvPw2FA:5Ni5U3/Aw0g5iRBEEq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2092	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2020 wrote to memory of 2092	2020	rundll32.exe	28
PID 2092 wrote to memory of 3040	2092	rundll32.exe	29
PID 2092 wrote to memory of 3040	2092	rundll32.exe	29
PID 2092 wrote to memory of 3040	2092	rundll32.exe	29
PID 2092 wrote to memory of 3040	2092	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 240
    3⤵
    - Program crash
    PID:3040