47bae0fe457cc3ce4d9e138ee9656fffabee745c93c41f65981720d4553cae94 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 20:33

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsWebJPDesk.dll
Size

5KB
MD5

fc34b87becc40a695c169b8107dc2029
SHA1

a89b52fa5988981b570aeb90dbbf25a85a3e092c
SHA256

1b29b2d82c46d548668301dc614e7b31bde40c8895ffab4f5415f59e9598dd13
SHA512

f130c4d82bdcca1ae66bb22888d755933b073acd58be6c837045315f3dfee216374c074fcf5714ac7cd83bf5f7ae886ee04890b9b3014ad47740592f248316e3
SSDEEP

96:y6GArdH8t9FdNUAY7YCsYOB0LKeiiJZTApYQpYlJ7Nk4K/27E:yFAM5Y7YCsqLKei3purC4w2Y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28
PID 2000 wrote to memory of 1076	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
  2⤵
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads