cc8983b7309b663c1c72075936be3f57cd11b602d4f60e7a642c709823bbf294 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/nsisos.dll
Size

5KB
MD5

69806691d649ef1c8703fd9e29231d44
SHA1

e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256

ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512

5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
SSDEEP

48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\nsisos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\nsisos.dll,#1
  2⤵
  PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads