0556e2b9e39b7e612cbf6fd7427c725b9af77f1d121fd2fb6082380431a131b0 | Triage

Analysis

max time kernel
135s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 10:19

Sharing

Report Analysis Logs

General

Target

Modules/nls.dll
Size

150KB
MD5

9313c69d0faac7ae780aaf14745ae67b
SHA1

6e3c5e16420a4338658bf35216082d7245cfe249
SHA256

00433a00a278381a29e8a172df422b088415ea8c34cbc617d5cf9666f5e96bb1
SHA512

4622f472ba257cf84a2e31847723c2125a2e2083f1c4ed7ed584350e8e4bd075bbae35a04c19c668283cf6cec5390ff952b86919988e577eea48c5d1fcbfbe8a
SSDEEP

3072:o/w1bxOjPhv3+aQb4aXY61q+0fztlZQTOoHwwzKZ:v1bYjZ2aQbzFzItlZQBHs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	4304	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4304	3328	rundll32.exe	96
PID 3328 wrote to memory of 4304	3328	rundll32.exe	96
PID 3328 wrote to memory of 4304	3328	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\nls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\nls.dll,#1
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 604
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4304 -ip 4304
1⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads