6a9089fce4d7fce05b4ec9783a529a6dc5b7b9bb7a38523ea32c135c2438f181 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 01:59

Sharing

Report Analysis Logs

General

Target

$R1/$SYSDIR/nsis_loader.dll
Size

24KB
MD5

cb004c514f4db290a92d0f072f6dc408
SHA1

49a52aac91ca5b10290872f80fcc8cca114fa6be
SHA256

ad0117c20a01ac779f664f2edfd7da0b8c77623e5301468c99ef6510db920a6f
SHA512

8d768433521eea54d3d7e274b8760f21e72c87881376299b987236bd95e7797814f71d23b2acae4b0a6d06a74b64093c993e2c3065374ed0bc678a0585cd9d98
SSDEEP

96:P0ITfF6zf9opvpctRDEtNmBOQmtNmCB8LxuA5nnWxy:P02fF6BwBczQnFQmnNB8LxPnWx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R1\$SYSDIR\nsis_loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R1\$SYSDIR\nsis_loader.dll,#1
  2⤵
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads