ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 15:35

Sharing

Report Analysis Logs

General

Target

bin/nssdbm3.dll
Size

100KB
MD5

8cc6a31974a175a65d6c090feed39f42
SHA1

30dfeddc8a4a59aeb7198d8cc9c712f3248a1e51
SHA256

f64111faa9966d7b7859c6467bedbd64559284b049f55ffadc54dfc50a3a4264
SHA512

597b2fb5ba96fe656e2c81d3d411adfc4e693510f130872e16c9cc70355b41fccfc0b9dbc16171af76e2caa7945fdf2519cea40b9ef1a161ed967346df595d5e
SSDEEP

3072:rHLNCxyxOuseQadJYO3bc3Vjo0ZQNf1v1ErPjH3XK:rrdrdJYOLt0ZG1gPjXX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nssdbm3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nssdbm3.dll,#1
  2⤵
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads