1b286678c8cdc68efc2c36261d6d898c456e24ce5fcc9e881423ba9402849037 | Triage

Analysis

max time kernel
133s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 23:25

Sharing

Report Analysis Logs

General

Target

Nanolib.dll
Size

64KB
MD5

c50198b0f9c47d3c886bef4c5b890d7e
SHA1

04e9037f7fb3da2b7a416c341c89ffa5e558e50c
SHA256

923ba4b6fe82e8a76363f791cc10a3aabb4eb3e7623cb944435cab9ebe8f4c7a
SHA512

764d5e2f83c6d1ed09b63690ea2c5cf2bc15aea5e72d3aa56649405ed064f227b262b153ac5cba059d4814022f1167c49661958fcde0d50533ec07119e919c82
SSDEEP

768:LylOd0rEZQ0PRKfZXc3vpQYrRFbuRwl7IQEtPD7+t6s6phDiumcR:Ly8SGQUwXwBQuRFbuRwhIRqtADio

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3668	5060	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 5060	4852	rundll32.exe	90
PID 4852 wrote to memory of 5060	4852	rundll32.exe	90
PID 4852 wrote to memory of 5060	4852	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nanolib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nanolib.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 600
    3⤵
    - Program crash
    PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5060 -ip 5060
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
1⤵
PID:1764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads