350f2b7af2310de1eec502397eb73b1e5c909b989294a1e988911c07a8ec616c | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:40

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

51beaeab1967c58754300c301d689698
SHA1

0b5bf1e3844d2b7e84eb8ab59893cf00dd555b53
SHA256

0ef301312fe2eb999b9ba6fa66fd0ba0f4a4c6cc6516e2dc1d56aaea5f1aeaca
SHA512

7574fb0475edcd3b015eed31dc9e47a8e18397408b397eccc9a50c50e5a2b3e76b4c822873be5a24981e47f848fae076c9addfe16f4f0af2b3e968769cf63f31
SSDEEP

192:rnAR+lPi8VpAweqU3Mh/8C3Km3P+QcmHSd:rn9lPiezWG8C6m/VPHS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4656	3056	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3056	4396	rundll32.exe	83
PID 4396 wrote to memory of 3056	4396	rundll32.exe	83
PID 4396 wrote to memory of 3056	4396	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 636
    3⤵
    - Program crash
    PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3056 -ip 3056
1⤵
PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads