397ff48f9ae2034c72bb9428427fbf6eca8df5b215723ba31094cf323f32df5e | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 05:58

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsisos.dll
Size

5KB
MD5

b1e1f665d57874de41df72dda21bc6a9
SHA1

4898d7b41b48ef6350b0b6730805f201e52e4cb4
SHA256

0619ec35b9632b28d84e39343b6dbc5ef9732c85f1ca97c05aee744d22b7e930
SHA512

9f3a5fcab235d15d2f477ec335d08a490c889842c227aed49179dab4fc909221c66d9d6110b465da8a4a4b07cac07192e22b1fd62d96e2494baf510858ea004a
SSDEEP

48:StaC3KocZctyk+T69J+dFk6wO1mvu1A8ZkcG64wlfCSCAD7:ly3cZeyk+T6J+dFaVuA8ZQ6L5CtAD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30
PID 2080 wrote to memory of 1952	2080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1
  2⤵
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads