bf0251e3e76a263068db92373e19bd646c695f75f5100799c569c76dd92c0c8b | Triage

Analysis

max time kernel
134s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 11:05

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsURL.dll
Size

276KB
MD5

00041c73dc322c96c1a128883ee2e249
SHA1

c13f7beb0a7c8da10d2e624fea642909d0fb15aa
SHA256

24d6944b630376e25cba2ff64b007d37b519699d18d77e0f01412c7d3a9aa9bf
SHA512

fe3e7cc71a8f2b74b7ed311ee138b1d3f2ac5c60bc6a647bee515ec9ee9f9ae635d1431dc5b963ffffaf8c54d70ee99c47a162f70aa14e45cd62f1cecabd8af7
SSDEEP

3072:oEAnycL2sxEpaZMpJuJKV4j/ILvJAL4+y4FUYcexRbO4/Fg:oEAycL/xTMewsMgykP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	3712	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3712	4156	rundll32.exe	84
PID 4156 wrote to memory of 3712	4156	rundll32.exe	84
PID 4156 wrote to memory of 3712	4156	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsURL.dll,#1
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 636
    3⤵
    - Program crash
    PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3712 -ip 3712
1⤵
PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads