4926529f95851a510ec50d009c427bd13875d70e6a5a715cd3ce7317ff5dcfa9 | Triage

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:44

Sharing

Report Analysis Logs

General

Target

NlsData004e.dll
Size

129KB
MD5

1b366404f1e7f7b2aaf92cf7a9430ddd
SHA1

095d2f801b3bc42e685b379195e375bdd1baa4e3
SHA256

4926529f95851a510ec50d009c427bd13875d70e6a5a715cd3ce7317ff5dcfa9
SHA512

c1c5bdf343e04bd45f8492021167e1074aa39c13ae5c4f7bc327a03d7fd51dc463a065c3c9e195d1ca0884325c4351abfa107ae0e90f2ca2e2838c8e4512e6d4
SSDEEP

3072:zC7TPPfny1w5BtR1kck1JCom2FKcoXtlcu7ziuZMV+:zC7Dq1w5BtRGceJCom2FKco9lfzi0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3388	3420	rundll32.exe	83
PID 3420 wrote to memory of 3388	3420	rundll32.exe	83
PID 3420 wrote to memory of 3388	3420	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData004e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData004e.dll,#1
  2⤵
  PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads