5830210b6b267b2e7bbea5cc295238bdd0a8362ec013c20f56d88f5fc4fcfea4

Analysis

max time kernel
144s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 12:43

Target

nanodump_ssp.x86.dll
Size

34KB
MD5

7bd007883059c6385dd4788c578d7aef
SHA1

251addc5b302d2a20950036d0a6a72f8332cd591
SHA256

5830210b6b267b2e7bbea5cc295238bdd0a8362ec013c20f56d88f5fc4fcfea4
SHA512

411b3755d362849ca26b59b819e58cb9bf55f6f5d1b20ecc620f61842338e740797c3159fafd394cfbdc1f4938b41d5a72cbdc8aa3670e8971c0aadac2e7f773
SSDEEP

384:3huaJT5MJGjb+hwvgdIDifmKaN9HPIR9hbzKZSoCOrSD8oTzfbEgFecpH:9T5LbSwvgdqMK1sKZkJYgQtkH

Score

5^/10

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B021A69D-FDA1-411F-A97A-5B15B6A99BD7}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9AA2C7F4-C38D-421A-A069-F217C54DCB04}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5BC1E052-D5ED-416D-8A79-D67A7B7CDAA8}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3E2F7F13-BF50-4B61-BB06-3567F07450F4}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{827C06C0-C5FA-48F2-9950-70861CC69FBB}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{91DAFEEF-61AF-418F-939C-6D8850A31C37}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9F9616A5-3023-4D6B-9713-53977255A604}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{880CD481-9427-4528-A4A1-6BB8CEF2C2AA}.catalogItem	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1492	632	rundll32.exe	83
PID 632 wrote to memory of 1492	632	rundll32.exe	83
PID 632 wrote to memory of 1492	632	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nanodump_ssp.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nanodump_ssp.x86.dll,#1
  2⤵
  PID:1492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1924

memory/1492-133-0x000000006C880000-0x000000006C891000-memory.dmp

Filesize
68KB

Download