209a4474cb7f906d4fd6c7df839841b7944b4917ec5f65bc0c92acfa552f9040 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:44

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsProcess2.dll
Size

35KB
MD5

6e96ea8b0dfdb326c0852a5b64d920a6
SHA1

5ea182cb6ae5c104ca064fa8464df8ed1904eaa7
SHA256

b8762c09c2b45fc836c65a9052951de05177651d278e4cf154c754d9f5573e7a
SHA512

02d0bd8f16ddad829b80764926f1e6dcfb35b60fbce02bec0a7fc2011164d86f633074af012de71fae33b90732ec4c7633f8a70ab24c19717926757f9c56fb4f
SSDEEP

768:TTc0PYmtVrjWQ7P4hEnn2OEDgzAwvc3F:Pc0P7VrjWQMw6Z3F

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	3780	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3780	4296	rundll32.exe	82
PID 4296 wrote to memory of 3780	4296	rundll32.exe	82
PID 4296 wrote to memory of 3780	4296	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcess2.dll,#1
  2⤵
  PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 600
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3780 -ip 3780
1⤵
PID:4684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads