b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4 | Triage

Analysis

max time kernel
39s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 06:09

Sharing

Report Analysis Logs

General

Target

nlwnsck.dll
Size

24KB
MD5

9ff3cb81d2c201f96b734c0db5a2ad48
SHA1

efd9ca0cb99ca4f74b70eb80ee69e17a8d22dbfd
SHA256

709efb99250ebf69a787e11c3f3d2561165fccad87a064e4387515d7c9511621
SHA512

52c6a8007fa138d996ed5f90f2f6b5102ede23b1bdda1f6a2c43048a4773e7fd602e65d6fd54e176af3a361fcaa6e9e97cd80c335cab77d240be8b92f1f55075
SSDEEP

192:cDswlM1zkgkXYP84lLtptsz9huZEdZntep:dtUAc9huyop

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27
PID 1928 wrote to memory of 2016	1928	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nlwnsck.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nlwnsck.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download