94a47191fb3a307fdaa84a1f8f31d8e1b4b79b34048814725c373e54f3d4e37a | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:20

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsNiuniuSkin.dll
Size

891KB
MD5

cb9ccb0f6923b5e38221a2c9603eb669
SHA1

7214cae53f36cab79841e9d49b07cffd7ce5e1c5
SHA256

6a38b8084e7493ff57ea3eda7101fbfd6113d8470531b479ce05cefb4e34bc79
SHA512

5d510870559737ba9f10447716a654e3aa609b64a1b753e2d3722b7b92e1768980d2ff070e639add57a13a7941c1d680ffa6e13abd47c44b1d18a230590ebb6c
SSDEEP

24576:1pIQCUFPxa+iDkpxMJIpgT62mQh8lZIn:yUFPxarJICm25oZE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28
PID 1340 wrote to memory of 2264	1340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsNiuniuSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsNiuniuSkin.dll,#1
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads