a24c03e63449db0f994c715115c7648e88182888305be3554ef8f9a9215a0501 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 04:45

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

14KB
MD5

cf1d851a552068aaa0515ecbff6f40d2
SHA1

e2cb25ac6cee0712486c8c2a7e00250a89554ca5
SHA256

38192df38514cabdd22e08cba2b3d27aac774ac8090a0f326d441718f47a82c6
SHA512

b76b86b8866c5b5556c361878b128e1ff5010585c79b733df4548ee7344cdde409d647afb1e50cdf8d33d74595bc2b8fa971ba4b80e78d00670d085a1871d832
SSDEEP

384:BepxuRgZvixzDILPx7EWKGKVlDJfU/HpYpym:BhRgZvcUxEzUvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 168
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-0-0x000007FEFAEB0000-0x000007FEFAEBD000-memory.dmp

Filesize
52KB

Download