f59b9ff344d986ea37b2af26bd6bdf4bba7d004b0f6efd82cfb050dc8b2e94ef | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 10:54

Sharing

Report Analysis Logs

General

Target

Plugins/vis_nsfs.dll
Size

28KB
MD5

39cad0f6b13242d45f6a25b1f90c4e19
SHA1

a8a283753a4d83b1197ad32af7938b0bfe50a986
SHA256

ac01813bbc6c5f715b7ac6588013693c5b5dac10b765a9fa176cbf87c5416a69
SHA512

ad92ec3919e8dfa859400f2ffd6976e4b849725141adee26e895677c3f017fbd8ff92e81f1326d3203fa9a4663044d5b49ae33df09402c2566551ed500e0fc93
SSDEEP

768:tzJlFU59dnePnsPYoMjm+78a2y2QzE8hjLV5/e0D1NXrd:8HdePsPY7IyjJ11

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28
PID 1704 wrote to memory of 2128	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\vis_nsfs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\vis_nsfs.dll,#1
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads