449bf249c170a1b3275c2a3ed45292244ecb49bf3be24ccef3809330de252d90

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:38

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

800aa26b2eb417363bf7ec155cd6c845
SHA1

eaec626eefb36850a90c3ffaa7eab1b8750aad1d
SHA256

c40817e6948ff1b6e1983ef9dd4f21394a81336e9fe2aea826eafe02a8df047e
SHA512

2714bbaa04f481ac6fd83f64106688299d34e6af33d3e13b890c1ca72b0570b9867d427deaab48ae1ee3fe836976f9ac4dac12feb1624787b6fb2787c8db9577
SSDEEP

96:GIKf21CuHq37MPuQ7rA9auHav8ZwK03cONByZyImHcAqgvB05CZnthgvsSluspKd:G5Om342wrA5apH3/NYmciACZUEEpU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1960 2316 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1960	2316	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 2316	1540	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1960	2316	rundll32.exe	WerFault.exe
PID 2316 wrote to memory of 1960	2316	rundll32.exe	WerFault.exe
PID 2316 wrote to memory of 1960	2316	rundll32.exe	WerFault.exe
PID 2316 wrote to memory of 1960	2316	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 240
3⤵
- Program crash
PID:1960