e49e2826c4d9fae960ca6baecd6754400e5da74446c5b511beb15831b42f2b1d | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-02-2024 03:54

Sharing

Report Analysis Logs

General

Target

NvSmartMax.dll
Size

20KB
MD5

0b21678ed8e2b117344cfceba8f097dd
SHA1

db53bb022cb6de016713f1570f2ae501f20f9c76
SHA256

eaaa7899b37a3b04dcd02ad6d51e83e035be535f129773621ef0f399a2a98ee3
SHA512

182268649b360f44f021570ddc9290f5051a8be556ffd66355bc325027ba48c5fe824e1bea925411bdaef4c17e0f3d81a1d3c710b59c4462540d567da625a41a
SSDEEP

24:eFGSE+O1B+ibXvS1vFNFPitSa25Jyj3xrqhx4/:ief+BFCtSa25JySx4/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28
PID 2376 wrote to memory of 2188	2376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NvSmartMax.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NvSmartMax.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads