0ab0bfdf37327537edf57751c1b2b07ec498b3c17c6782d2a2b6b535f353cfd3 | Triage

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 10:16

Sharing

Report Analysis Logs

General

Target

$TEMP/$_90_/MyNsisSkin.dll
Size

324KB
MD5

c42575c6e2e273c04eb7bc3e4119e337
SHA1

658e3d042e28196a321ee6446b9e6845d5478abc
SHA256

9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736
SHA512

b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308
SSDEEP

6144:FOrNKQjNQnWqJolkFucBm1fXr9ICcYerKJbYm3IyU:F4NKQjNQfqOuEm1fXncdrKJbJg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4628	3928	rundll32.exe	83
PID 3928 wrote to memory of 4628	3928	rundll32.exe	83
PID 3928 wrote to memory of 4628	3928	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_90_\MyNsisSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_90_\MyNsisSkin.dll,#1
  2⤵
  PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads