ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200 | Triage

Analysis

max time kernel
54s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 15:35

Sharing

Report Analysis Logs

General

Target

bin/nssdbm3.dll
Size

100KB
MD5

8cc6a31974a175a65d6c090feed39f42
SHA1

30dfeddc8a4a59aeb7198d8cc9c712f3248a1e51
SHA256

f64111faa9966d7b7859c6467bedbd64559284b049f55ffadc54dfc50a3a4264
SHA512

597b2fb5ba96fe656e2c81d3d411adfc4e693510f130872e16c9cc70355b41fccfc0b9dbc16171af76e2caa7945fdf2519cea40b9ef1a161ed967346df595d5e
SSDEEP

3072:rHLNCxyxOuseQadJYO3bc3Vjo0ZQNf1v1ErPjH3XK:rrdrdJYOLt0ZG1gPjXX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4204	5048	rundll32.exe	83
PID 5048 wrote to memory of 4204	5048	rundll32.exe	83
PID 5048 wrote to memory of 4204	5048	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nssdbm3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nssdbm3.dll,#1
  2⤵
  PID:4204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads