260687b1e1ee90adb739fa9e618be63ae531952ad3f955b8d6ce70c773cd5cf5 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 02:42

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

b0165587c54350b6c9910e765f16ad9e
SHA1

fd81de9f3b1dd8d6cfa8621fddf9f93c29b4710f
SHA256

26006c739057373f948b11892f40b0cc686c6c97c448f79447856421f9a15563
SHA512

2f69354fd433eec277a804124f5c476fd645270b89af3db22ed45b599cdf251cfccdc3c642b8893078748a0a674676ea28c5fe5b471a633de7301c6a6646295b
SSDEEP

192:bzQhZDqlJcKISw99ioU3MSfwLF/+nhHUOFsdz:bzoZDGKYw9goWyFGBUVz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2328 2324 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 2324	1468	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 2328	2324	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 248
3⤵
- Program crash
PID:2328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...