0f3bfdf1fccfa3d80af6edb597a5071099825be60264c230a0da29ca49dfd31a | Triage

Analysis

max time kernel
134s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:18

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsisdl.dll
Size

14KB
MD5

732b08d61117e442df209d6e2e4165a4
SHA1

4ced1f43e94800dd08f6c2efc73be978dbca028b
SHA256

73a1d4339513125be547a038321e26a3de13593df96ed715efd8a1683ccc0665
SHA512

f79e75f2637072c07f55f6e2192a1c7a997f184432a8179afde38656034b3167fc3e275755c17f298b9f554c7a20571aa4df165248a42315c5f1a1aa52bedc03
SSDEEP

384:yck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2+E:yck76gibLCMLDLCx04HNV+E

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3720 1280 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4840 wrote to memory of 1280	4840	rundll32.exe	rundll32.exe
PID 4840 wrote to memory of 1280	4840	rundll32.exe	rundll32.exe
PID 4840 wrote to memory of 1280	4840	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
2⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 628
3⤵
- Program crash
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1280 -ip 1280
1⤵
PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads