90263f5e0ceee73af6ee6ca4dac8e6441c1f5c39607512a954e42887a5a0bb3a | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:42

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsisdl.dll
Size

15KB
MD5

5fadae311a0c96a8314f463520a08bf3
SHA1

7c4445bd00985050546b473f1892e5e917fbb058
SHA256

93d03b5b15484e37315f3f0bb1d60a38e666fe714a9a0a28f831f6228c587562
SHA512

045d1bbf9802b204354757c94d0b90fc3b9f490dc3d68b12ec0fc83e127c3544c123df3cabb9a4285742d38fa9bcfaf376c800ba3cbbfd84ac624dc89a1dc4b9
SSDEEP

384:dhyd8Y6pu8ZaLf6Uksnw1g8BUcyHisUOb:dhyd8Y67WGg8B/Eie

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2908 1772 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 1772	2784	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2908	1772	rundll32.exe	WerFault.exe
PID 1772 wrote to memory of 2908	1772	rundll32.exe	WerFault.exe
PID 1772 wrote to memory of 2908	1772	rundll32.exe	WerFault.exe
PID 1772 wrote to memory of 2908	1772	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 228
3⤵
- Program crash
PID:2908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...