6fc60098366fcadc7f08df3746881742f1fb30a91e2047b7b14951a6861dc214 | Triage

Resubmissions

28/03/2025, 09:56

250328-lybnsswnz8 3

28/03/2025, 09:55

250328-lxrcvst1fz 3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:55

Sharing

Report Analysis Logs

General

Target

nspr4_x64.dll
Size

353KB
MD5

89bb5a937cb3364e45bb5a522fd5ff36
SHA1

424647f58ec0760f8efd6cf4e5a35fc01a8cb83d
SHA256

f91fb6b450b303e40c3fef59b18420628a3ffcc3295ea75d1661c51357e6dabc
SHA512

09145224edcce389cc4a251d68e23c950b960760b0d92360ec60f35161b7fe242fb8ae749d4fe180303fcb9c8bfd69cb71a73c0ef4a8227c0b1f5f514f96c27b
SSDEEP

6144:CstlJzDk2RJVbd0XpSGlTqatRYpNVqKJ+3Dn+gt1:CMlWYJVhKnl+yENRAn+W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2264	2124	rundll32.exe	30
PID 2124 wrote to memory of 2264	2124	rundll32.exe	30
PID 2124 wrote to memory of 2264	2124	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nspr4_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 96
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads