5cfaec15d48d36b15ac725930e3203e30e40bf17fc0d11de83d5e4f42a0f717c | Triage

Analysis

max time kernel
94s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

11KB
MD5

6e6ea06ff64142decd1544965704b3a3
SHA1

34b3065cdd40d48f4ffaf26b1a35bafefb0bd989
SHA256

eac6e063d05453f4917b1f892c864f412d5734e9c01f0b37e62802df0e51bc96
SHA512

7f49c929059bd56c403406e473c5de64b076c1b1011922d4e64967750c1ecdc47c682d68c910744ff6ccf19ed00e3ad55eab5f10775fcbaa08ca3c746e3b15ea
SSDEEP

192:dimuo2iXsGk7lXtUil/HdJZC9jToTlHY0QvKwaHrEmK:sK8zmihi0VYLMHrNK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	2500	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2500	2132	rundll32.exe	85
PID 2132 wrote to memory of 2500	2132	rundll32.exe	85
PID 2132 wrote to memory of 2500	2132	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 636
    3⤵
    - Program crash
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2500 -ip 2500
1⤵
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2500-0-0x000000006E940000-0x000000006E94A000-memory.dmp

Filesize
40KB

Download