b140f8ea2fa569daa662f64dea3975e0a81168d37f20321c1c9ff81110b58bd4 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:00

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/nsWebJPDesk.dll
Size

70KB
MD5

093b52aac933d0934a4ca56079de22a6
SHA1

373cfe9f7bc5585129173df87c2fc66dc82153a8
SHA256

45166372c203eae40a6b33300df5bbabd3c95c614a833ea321966e8fe4d5a307
SHA512

56f2b87ca4c62e6cdbf7327be13c8fdc9545d58390689c517d9e8ad308d17661c3100ad45198a226d378661b16178424cc3979b5691daa5389a6807eb2237cd3
SSDEEP

1536:y6M5gYA232LFqYiAo5ATF//b9pQveR/8ejktvXNkHg6UR01:Y5gYOFiiBz0yPYx21

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30
PID 3016 wrote to memory of 3020	3016	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsWebJPDesk.dll,#1
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads