742c6154c02e545aadebb74f765151a5527db6893fb32ca72f6a916f400dd806 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:33

Sharing

Report Analysis Logs

General

Target

$TEMP/$_89_/MyNsisSkin.dll
Size

324KB
MD5

c42575c6e2e273c04eb7bc3e4119e337
SHA1

658e3d042e28196a321ee6446b9e6845d5478abc
SHA256

9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736
SHA512

b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308
SSDEEP

6144:FOrNKQjNQnWqJolkFucBm1fXr9ICcYerKJbYm3IyU:F4NKQjNQfqOuEm1fXncdrKJbJg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2156	1804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_89_\MyNsisSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_89_\MyNsisSkin.dll,#1
2⤵
PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads