98598c90bd75b930aba968467f4b540a5784aa28612b8010d8a9cf31992843c6 | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 19:05

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/NScurl.dll
Size

3.6MB
MD5

16e134ec014d74e9b798c9b3fae3ddcc
SHA1

1a8cc259f7b193018167484c30d8803b09ed228e
SHA256

eda02e626e8ca71dbff5389c062f9e9542661b43413b0a37ae3d262567145ce2
SHA512

3e5742934076066125b82f4b2da45a499b22440252dff4ec14660fc688f075f886ac76de89f4c6647a8c85e483c83507edfcb22e3dbe3363e509ae18b1c4636e
SSDEEP

98304:yXbm8hg9ZNN1FVyQ2Ufa2Zx/tlILkUYhK:yC8hg9vj3nfam/rykUiK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3172 4048 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4832 wrote to memory of 4048	4832	rundll32.exe	rundll32.exe
PID 4832 wrote to memory of 4048	4832	rundll32.exe	rundll32.exe
PID 4832 wrote to memory of 4048	4832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 640
    3⤵
    - Program crash
    PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4048 -ip 4048
1⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4048-0-0x0000000075020000-0x00000000753BA000-memory.dmp

Filesize
3.6MB

Download