831f9df1ba37bd3997e1e76c4c201ff7a6f9a3bfac78ed7abc8ffb631e83c535 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 04:25

Sharing

Report Analysis Logs

General

Target

NiceHashMiner_v1.7.4.2/msvcr120.dll
Size

940KB
MD5

9c861c079dd81762b6c54e37597b7712
SHA1

62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
SHA256

ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
SHA512

3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
SSDEEP

24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2392	2372	rundll32.exe	30
PID 2372 wrote to memory of 2392	2372	rundll32.exe	30
PID 2372 wrote to memory of 2392	2372	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NiceHashMiner_v1.7.4.2\msvcr120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 80
  2⤵
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads