147372abcb7cc8c3038559929343140f08e467dce00ca2cc89775def51ab4e16

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 13:00

Target

NlsData0007.dll
Size

1.9MB
MD5

cb6750ccbbf300550a4b44690bf43769
SHA1

bcf7d7fa09597b6236175117bdf16f8253a2fd0b
SHA256

147372abcb7cc8c3038559929343140f08e467dce00ca2cc89775def51ab4e16
SHA512

855cae1cbe95b2045b94221b30456c02dc6d089b0331832d7b446ebffdfa1d4a2902f007f45a18881f4c295d340cb25114fb322abf99e0cb490a9a975cd38da8
SSDEEP

24576:/izD4xGZXbkkkkEAy3kkkkikkkkkkkkkkkkkkkkkkkkkkbkkkkkkkkkkkkkkkkk+:/Ocm6O8S+j6gB9RwmjJROH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	4788	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4788	1996	rundll32.exe	83
PID 1996 wrote to memory of 4788	1996	rundll32.exe	83
PID 1996 wrote to memory of 4788	1996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData0007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData0007.dll,#1
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 600
    3⤵
    - Program crash
    PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 4788
1⤵
PID:4676