7d7ee0e33727d9db6fe70aaf56f3e4ecea1a7a01e4880586384e25ab07e3927d | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 16:37

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsDialogs.dll
Size

9KB
MD5

b0165587c54350b6c9910e765f16ad9e
SHA1

fd81de9f3b1dd8d6cfa8621fddf9f93c29b4710f
SHA256

26006c739057373f948b11892f40b0cc686c6c97c448f79447856421f9a15563
SHA512

2f69354fd433eec277a804124f5c476fd645270b89af3db22ed45b599cdf251cfccdc3c642b8893078748a0a674676ea28c5fe5b471a633de7301c6a6646295b
SSDEEP

192:bzQhZDqlJcKISw99ioU3MSfwLF/+nhHUOFsdz:bzoZDGKYw9goWyFGBUVz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2100	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2100	1872	rundll32.exe	81
PID 1872 wrote to memory of 2100	1872	rundll32.exe	81
PID 1872 wrote to memory of 2100	1872	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 636
    3⤵
    - Program crash
    PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2100 -ip 2100
1⤵
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads