126e5553fc40e4ecd36dbbedfbb39cced9b956b224122fe9df25f5d86081628f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:42

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsisdl.dll
Size

15KB
MD5

dd893b05df4fae0be652dfb188cd02d1
SHA1

a93eed746ad7c87e84e95594b928236eac4c6aed
SHA256

334697f5ae532cbd6274a17f2009d21acdece8e21735cb16cf2c09262be7cfa2
SHA512

baaa24e1deea742298ed4a361f70b568106fe462b71689b6394daa805ae898f246b4d417a176f66aec192ae0d64bafee555bb95388e02d3304b4a73a2f2f42f4
SSDEEP

384:Ahyd8Y6pu8ZaLf6Uksnw1g8BUcyHisULb:Ahyd8Y67WGg8B/Eib

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

320 1652 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1652	2316	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 320	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 320	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 320	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 320	1652	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 224
3⤵
- Program crash
PID:320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...