9bc495716554f2a24c0f9bcc93b02eb5b1f199f1a8407713e56b46c42d4c0324 | Triage

Analysis

max time kernel
138s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NL7Data0011.dll
Size

6.9MB
MD5

ed645e1a33c361a69339283794e2e65a
SHA1

271c7559186ee1cd7804b29e8c653cd004c8920a
SHA256

9bc495716554f2a24c0f9bcc93b02eb5b1f199f1a8407713e56b46c42d4c0324
SHA512

cdeeb6f43e4b217eb70838f1cf3ba94aea3a59c5a158dcf11bd92d35046bc516140cfe3dce6e2127f5cdf47213ea8a25f6aa5fb9bfb6e0e02aa76117843998b8
SSDEEP

49152:qD734ttFZjAdEBykLetOCbX3Z3AwWX/XK8rr8dZZXwFZShu6:qD734adEqtZrRADpr4LObShu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	3376	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3376	2720	rundll32.exe	82
PID 2720 wrote to memory of 3376	2720	rundll32.exe	82
PID 2720 wrote to memory of 3376	2720	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NL7Data0011.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NL7Data0011.dll,#1
  2⤵
  PID:3376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 600
    3⤵
    - Program crash
    PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3376 -ip 3376
1⤵
PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads