a71a523decefb6c64d90f86100044c04d0266665bceff6209f85465c01713052 | Triage

Analysis

max time kernel
136s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 12:11

Sharing

Report Analysis Logs

General

Target

NmaDirect.dll
Size

217KB
MD5

a68928c3dafbf3fa1deee7ed6d281a0a
SHA1

b63f29a40db588d2f6cf9e376a394d4ee5a011e1
SHA256

a71a523decefb6c64d90f86100044c04d0266665bceff6209f85465c01713052
SHA512

998e82bea476e19125d028bc5fd7564da5ae403ebe4bc022f41750930c3b95ee7fe7283e97c19386128b3b872e7cb892c624963b5d3cacd797cb3615025e0e63
SSDEEP

6144:zrMSJLiz4fEaTg5yHnM4PqJ/CfQkxAszo3W6z+:zrMcLgleg5yHE/Cf5xB0v

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3740	2508	rundll32.exe	82
PID 2508 wrote to memory of 3740	2508	rundll32.exe	82
PID 2508 wrote to memory of 3740	2508	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NmaDirect.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NmaDirect.dll,#1
  2⤵
  PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads