9f8b2a8b20424b1ae88d51389b708e1a8985df838b57b6458ed4ce7841c64802 | Triage

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NlsData004a.dll
Size

3.0MB
MD5

8848ed63994d6e84243a71fa2376712c
SHA1

3df796c82e7a52cc585536ba63211ae1451e834c
SHA256

9f8b2a8b20424b1ae88d51389b708e1a8985df838b57b6458ed4ce7841c64802
SHA512

73a6c11c858322daea5c1b26f0a8267a97da46d2d755735ac6763b89e553c9081628549b5b4a24a150b7d689889737b61323700c5f9f03ca583a47202f0a0382
SSDEEP

24576:OJEJNe9wndvrpof5UUv6ujcqJByewHXqQpiPlv9qSabr:e9CNofaXXqQpgqlb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3304	2640	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2640	1712	rundll32.exe	82
PID 1712 wrote to memory of 2640	1712	rundll32.exe	82
PID 1712 wrote to memory of 2640	1712	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData004a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData004a.dll,#1
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 600
    3⤵
    - Program crash
    PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2640 -ip 2640
1⤵
PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads