f59b9ff344d986ea37b2af26bd6bdf4bba7d004b0f6efd82cfb050dc8b2e94ef | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 10:54

Sharing

Report Analysis Logs

General

Target

Plugins/vis_nsfs.dll
Size

28KB
MD5

39cad0f6b13242d45f6a25b1f90c4e19
SHA1

a8a283753a4d83b1197ad32af7938b0bfe50a986
SHA256

ac01813bbc6c5f715b7ac6588013693c5b5dac10b765a9fa176cbf87c5416a69
SHA512

ad92ec3919e8dfa859400f2ffd6976e4b849725141adee26e895677c3f017fbd8ff92e81f1326d3203fa9a4663044d5b49ae33df09402c2566551ed500e0fc93
SSDEEP

768:tzJlFU59dnePnsPYoMjm+78a2y2QzE8hjLV5/e0D1NXrd:8HdePsPY7IyjJ11

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4912	1504	rundll32.exe	44
PID 1504 wrote to memory of 4912	1504	rundll32.exe	44
PID 1504 wrote to memory of 4912	1504	rundll32.exe	44

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\vis_nsfs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\vis_nsfs.dll,#1
  2⤵
  PID:4912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads