449bf249c170a1b3275c2a3ed45292244ecb49bf3be24ccef3809330de252d90

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 13:38

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

800aa26b2eb417363bf7ec155cd6c845
SHA1

eaec626eefb36850a90c3ffaa7eab1b8750aad1d
SHA256

c40817e6948ff1b6e1983ef9dd4f21394a81336e9fe2aea826eafe02a8df047e
SHA512

2714bbaa04f481ac6fd83f64106688299d34e6af33d3e13b890c1ca72b0570b9867d427deaab48ae1ee3fe836976f9ac4dac12feb1624787b6fb2787c8db9577
SSDEEP

96:GIKf21CuHq37MPuQ7rA9auHav8ZwK03cONByZyImHcAqgvB05CZnthgvsSluspKd:G5Om342wrA5apH3/NYmciACZUEEpU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2556 3996 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2556	3996	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4072 wrote to memory of 3996	4072	rundll32.exe	rundll32.exe
PID 4072 wrote to memory of 3996	4072	rundll32.exe	rundll32.exe
PID 4072 wrote to memory of 3996	4072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
2⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 636
3⤵
- Program crash
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3996 -ip 3996
1⤵
PID:3788