79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21 | Triage

Analysis

max time kernel
143s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 22:20

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

14KB
MD5

494c8f9c6a5fc302e8b50f05ef9aeb8c
SHA1

75fe258210f0989a7afaecd42e45841d076dc8b8
SHA256

e9ab864697d454cd4a85abf38ec4236ee56ddd0c59f9422ae1e774b9487f132d
SHA512

363780eeded89bd720addb11ef42893d13852fe1c446305cbda73cf994da6848338458f2da4eafa42857533e6fc30e24f6db3b36df5f7cc51b9307010ddfa401
SSDEEP

384:DqWL5JCYXh2OPxv9OIR6oYkvLlAPPPbgS+dXA2N:DqXG2cLR9v2gBnN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3760	4540	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 4540	1604	rundll32.exe	87
PID 1604 wrote to memory of 4540	1604	rundll32.exe	87
PID 1604 wrote to memory of 4540	1604	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 636
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 4540
1⤵
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-0-0x0000000074A20000-0x0000000074A2C000-memory.dmp

Filesize
48KB

Download