3c43380328abbfff5767f38a84bf884ee48b59a29f46159d84a57a92fde49878 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 03:05

Sharing

Report Analysis Logs

General

Target

$TEMP/$_90_/MyNsisSkin.dll
Size

324KB
MD5

c42575c6e2e273c04eb7bc3e4119e337
SHA1

658e3d042e28196a321ee6446b9e6845d5478abc
SHA256

9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736
SHA512

b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308
SSDEEP

6144:FOrNKQjNQnWqJolkFucBm1fXr9ICcYerKJbYm3IyU:F4NKQjNQfqOuEm1fXncdrKJbJg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_90_\MyNsisSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_90_\MyNsisSkin.dll,#1
  2⤵
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads