2163394fe3e8a630cebd0f44e57c1fea5890a24773327db138a72ee1886eb263

Analysis

max time kernel
140s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 10:55

Target

$PLUGINSDIR/nsDialogs.dll
Size

14KB
MD5

2726673c720a296442c8ed134b41d169
SHA1

b8050c85017fcda78f6b82cc86ad277bb0dbd539
SHA256

778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
SHA512

95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
SSDEEP

192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	1628	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1628	640	rundll32.exe	85
PID 640 wrote to memory of 1628	640	rundll32.exe	85
PID 640 wrote to memory of 1628	640	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 636
    3⤵
    - Program crash
    PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1628 -ip 1628
1⤵
PID:2832

memory/1628-0-0x0000000075560000-0x000000007556C000-memory.dmp

Filesize
48KB

Download