c55732168517ea7a91d294844d2e32da201bb31e95ec484f68f29fa5efb5e08b | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 17:04

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/NSISArray.dll
Size

32KB
MD5

8b43a3f284632edfbb51665b2e0b8a3c
SHA1

af6ab111856be7af7212a82b052e8b5656159b35
SHA256

336e588999bf6b1cd6c894dbf5a73b2198d48c935f8b1251687845cce467dc67
SHA512

3a9add285d074db534937b193b92f8e0503c94c97b11f0abe5d9358342fbc57461ba1f559fa19e0522cfec914b8a007f11bec34abef17faaca5de8bda0dbaf94
SSDEEP

768:uCyg1AT+KRSHKrHrkJg81qdJd18atH18Hup23+zj+:WgcwHgn8Uh8an8t0+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2380	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2380	4964	rundll32.exe	82
PID 4964 wrote to memory of 2380	4964	rundll32.exe	82
PID 4964 wrote to memory of 2380	4964	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISArray.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISArray.dll,#1
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 600
    3⤵
    - Program crash
    PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2380 -ip 2380
1⤵
PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads