7e59a2c14c0c40c39517f405785963d1fd2810ad5976c2f30fdbee38f90ef2e6 | Triage

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Windows Media Player/npdsplay.dll
Size

356KB
MD5

f77fc9a1b8e7d19c975ebd3af559e5df
SHA1

1f9bbef151d588aa39f036d3fa9e062ce0edb5aa
SHA256

55669bf27e76c7f3a147491c2fdea45647812a30cb2fd0f2ab52acf4aca52d59
SHA512

13365411a54d94d11499fcc8e916a2dc6171b40ffd4c1071bf74258f41f555e43d851b15a0a1bc4b2f0db9f91f9aed40e9dd0f40e4790f611db091569e30071c
SSDEEP

6144:fo4PCy095ixKmMtaIPMBNPOjdRo4YGHDJ+NNbL7F:UvixlMtaIkjmj3/YGjJ+NNb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4980	1020	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1020	4492	rundll32.exe	14
PID 4492 wrote to memory of 1020	4492	rundll32.exe	14
PID 4492 wrote to memory of 1020	4492	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows Media Player\npdsplay.dll",#1
1⤵
PID:1020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 664
  2⤵
  - Program crash
  PID:4980

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Windows Media Player\npdsplay.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1020 -ip 1020
1⤵
PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads