632e3afccd98120934bce68913c7f8983b79262006325be931ef76fab16225c2 | Triage

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 09:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDui.dll
Size

3.6MB
MD5

49acf8a23320b121f3a07149a1ec9dd0
SHA1

117ba008ac99b79afdd9ae0a3839be2fe8662c11
SHA256

a94c7412b0f82f46b75110e7ff5d0b501ca1a2f026f87c90d7542d864aa318b1
SHA512

4cc9dadb098fd32727bee7585aaaddb9435cc3993c9a2f00d31f0bf5267bba17326d1b6f87de3130dca04998d6c05294d74cda352e5ed9f16ac1537c98993f7a
SSDEEP

98304:OYm+jAz++6O5CRXmd2b4Ah0PH3+qAgyPi+qiLvmrEGm:dnpQ5COCwOqAtqavtG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1136	2448	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2448	5108	rundll32.exe	85
PID 5108 wrote to memory of 2448	5108	rundll32.exe	85
PID 5108 wrote to memory of 2448	5108	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDui.dll,#1
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 680
    3⤵
    - Program crash
    PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2448 -ip 2448
1⤵
PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads