Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 03:08

General

  • Target

    $PLUGINSDIR/NSISdl.dll

  • Size

    14KB

  • MD5

    33d4a515252e42901fcd3230a749e92f

  • SHA1

    168ccf18807f372d59c954425b23e3ba07b9e32f

  • SHA256

    83817610e28c78c766a183e66d9fa47f1831b702846cae2ec51ba5848c9dbde1

  • SHA512

    fcd40f466403d3243d8a8d2e98aae74f46d5b5e9e254d13485281e86022305a3e8d47c6411175a9f2f90ad8d10aa40614c71329969ef895a20d60688a649adba

  • SSDEEP

    192:HPv+wTtD0MzoU7Fs0+/gcDmduwJQXzw+KtnvH0tKO/B75D/Vp6kn2HgsDw0:HPFT90MzRF4/Bj0v0tP9gk2ZDw

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 224
        3⤵
        • Program crash
        PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads