6a9089fce4d7fce05b4ec9783a529a6dc5b7b9bb7a38523ea32c135c2438f181 | Triage

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 01:59

Sharing

Report Analysis Logs

General

Target

$R1/$SYSDIR/nsis_loader.dll
Size

24KB
MD5

cb004c514f4db290a92d0f072f6dc408
SHA1

49a52aac91ca5b10290872f80fcc8cca114fa6be
SHA256

ad0117c20a01ac779f664f2edfd7da0b8c77623e5301468c99ef6510db920a6f
SHA512

8d768433521eea54d3d7e274b8760f21e72c87881376299b987236bd95e7797814f71d23b2acae4b0a6d06a74b64093c993e2c3065374ed0bc678a0585cd9d98
SSDEEP

96:P0ITfF6zf9opvpctRDEtNmBOQmtNmCB8LxuA5nnWxy:P02fF6BwBczQnFQmnNB8LxPnWx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4952	2828	rundll32.exe	84
PID 2828 wrote to memory of 4952	2828	rundll32.exe	84
PID 2828 wrote to memory of 4952	2828	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R1\$SYSDIR\nsis_loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R1\$SYSDIR\nsis_loader.dll,#1
  2⤵
  PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads