fa75c37b3542a39489f72dade86cd1679e0a42cf373e52950b571148e494e40b | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:39

Sharing

Report Analysis Logs

General

Target

NlsData001a.dll
Size

1.9MB
MD5

2d6314aecda74e63124e5ac221d4879e
SHA1

06a1a7d09a7fe3c37604b6a6d32870402e1283f5
SHA256

fa75c37b3542a39489f72dade86cd1679e0a42cf373e52950b571148e494e40b
SHA512

9c348ea0faf4579aa70065006083a3d847c8e144bfef71ac745eba8cec0cf4b5d7f77095ef07c06401e673d81b6c677e01ae54e8937ede7e05385c131ff5ac34
SSDEEP

24576:OpHWcAbes/4jtCJ1EOAQ4HQWMxYlKpXBFVI3:PcAbF/lbElQRWMxYlKBVI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	3672	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3672	3952	rundll32.exe	82
PID 3952 wrote to memory of 3672	3952	rundll32.exe	82
PID 3952 wrote to memory of 3672	3952	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData001a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NlsData001a.dll,#1
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 600
    3⤵
    - Program crash
    PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
1⤵
PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads