879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9 | Triage

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 00:30

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

15KB
MD5

8cd70f1945da79795ff2efabecbad6c6
SHA1

47ce283d49703babd6c54465937ccef75c8a74cd
SHA256

9f95e57131a751dd802389271af6dd673ed68345024f09037835e3aacd46cd62
SHA512

6b620f86d24516dcc2da142ee79b630d7fccdebaddeee1adda58a5fadd7174d72a6bcb0777d63e3cf571ae4d1d94088cc007213b3f75755b8fd97a383dde7dc6
SSDEEP

384:8A7k8985U30WAw0hGIFc5f4c8ZpH3GCJEAvPw2FA:5Ni5U3/Aw0g5iRBEEq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	4428	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4428	3808	rundll32.exe	88
PID 3808 wrote to memory of 4428	3808	rundll32.exe	88
PID 3808 wrote to memory of 4428	3808	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 636
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4428 -ip 4428
1⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4532,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
1⤵
PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads