ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 15:35

Sharing

Report Analysis Logs

General

Target

bin/nssutil3.dll
Size

108KB
MD5

c19416e9cf9e571068ca14276c6e0620
SHA1

b5e8ee4659b678fb3b234055b1eeda920eb20b30
SHA256

ba9341807b42e90bb0380d51a83d3d6a0de7d57b6820a8b0cbe5e36e978860fa
SHA512

5cde579f66e0677f1419dc11723e1f7b5a7d408b4b3250e26aa0c0863a46b6fd86f17813416769f1eec89375f3c9c83fed468a17d1ef80f83ff1744927e7da79
SSDEEP

1536:QlEUXeNbfEzPX5FdEsom/cbvczqvooFPrSd8kBlUT1SB:qlybfEbXTd5wbvYqf0d8kBlUT1SB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2928	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2916 wrote to memory of 2928	2916	rundll32.exe	28
PID 2928 wrote to memory of 2992	2928	rundll32.exe	29
PID 2928 wrote to memory of 2992	2928	rundll32.exe	29
PID 2928 wrote to memory of 2992	2928	rundll32.exe	29
PID 2928 wrote to memory of 2992	2928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nssutil3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\nssutil3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 228
    3⤵
    - Program crash
    PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads