9d6ed95597857927f0e7e6eb1495c4ec10fa74aced7efbc9199c4392be7585a6 | Triage

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:57

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsWeb2.dll
Size

199KB
MD5

c76e67b9aa2f014a24702eb44aa5316e
SHA1

a7b46b8bc1d379a02fa110cc408dfab22f77961b
SHA256

68180cbe24f40f983583047cf8a0392307f21ddc0b459ee1654610852aa89504
SHA512

be4f9b92f702fb0317f716e542d525c809a29880ebf84398d0f96859b77b5eb80704d55b55f0fcb3b2a48cbc416679a9727789ff947551f2e8c5fb3bb06e3d0e
SSDEEP

3072:XKFoqBrrribYaLisz1gKJAHbUpE7CnoltUs5TMWa/S1T:XKC5d9AnMRS1T

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2516 3696 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3716 wrote to memory of 3696	3716	rundll32.exe	rundll32.exe
PID 3716 wrote to memory of 3696	3716	rundll32.exe	rundll32.exe
PID 3716 wrote to memory of 3696	3716	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWeb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWeb2.dll,#1
2⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 620
3⤵
- Program crash
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3696 -ip 3696
1⤵
PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads