5623905a55b1085e8998ab168b97b623def1a823e97fa67ccb4916bee3f2d1fb

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 17:45

Target
nssutil3.dll
Size 6.2MB
Sample260724-wb4feahg59
SHA256 5623905a55b1085e8998ab168b97b623def1a823e97fa67ccb4916bee3f2d1fb
MD5 12b21380cfad53a7b34629ecc21ee3c3
SHA1 033d117047798371f0054f1ebf5a8653e7f325d0
SHA512 4a9a5105723c72c67238b1af52869c29370b64c60349bc00a6396e2d3076d7600c3f3d684f8c5d6095e137cbc16c08827d12cb119e98ab45153eb39a8289e484
SSDEEP 49152:baklBqciFGiUx2YZ0TxTR0CO8b6TFADnKPlOGkFc949IRrNYl6zn3WRguUaSiCmN:wnYGODBUCZS3cDBamc2l8Pn
TLSH
T129666B03E294C0FAC09EE2B5C747973EEA75B4C6D565B65F0BE40B212E25B649B0F708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4840	4592	rundll32.exe	89
PID 4592 wrote to memory of 4884	4592	rundll32.exe	90
PID 4592 wrote to memory of 6060	4592	rundll32.exe	92
PID 4592 wrote to memory of 4996	4592	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nssutil3.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe"
  2⤵
  PID:4840
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe"
  2⤵
  PID:4884
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe"
  2⤵
  PID:6060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe"
  2⤵
  PID:4996

memory/4592-0-0x00007FFE9B100000-0x00007FFE9B739000-memory.dmp

Download

memory/4592-13-0x00007FFE9B100000-0x00007FFE9B739000-memory.dmp

Download