5754f98a7a476117464cec79c9d0cd8029717f865e87c2d551973a965bf5b21d | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 11:01

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsWeb_DispOffr.dll
Size

67KB
MD5

98bd2ebc8800a00bdf52b793c1210edd
SHA1

5cbe6cf1cde5c7a24c3349a77afb05257e7edccc
SHA256

3c3f9056a485f11adeb26fac811654a5d5890920ce529eade98f2534c7631804
SHA512

2b54c602d015318d097ce0aa980ed2f2bab7fa37c76c626c464d3dde07f24c651b2edc5949b1b2b198ad53444832d9b9a0fd104710aa4cacee00b905a81286f5
SSDEEP

1536:UwWEfx4Abg9IwWd7ZI3dWd6rKn92FJXB:UwWEfx41IT3IEd5AFJR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4064	4472	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 4472	1916	rundll32.exe	83
PID 1916 wrote to memory of 4472	1916	rundll32.exe	83
PID 1916 wrote to memory of 4472	1916	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWeb_DispOffr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWeb_DispOffr.dll,#1
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 624
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4472 -ip 4472
1⤵
PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads