1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 17:28

Target

1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee.dll
Size

1.5MB
MD5

6132f1e4315b435ece3c79394123a155
SHA1

acdfb6ff29c249936c0c698221b4cfa046eee1f7
SHA256

1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee
SHA512

2cfadb1f08710a19087d4ef433c4754c0d9c25d94d62662b9fd4eaf2f672b76d285e52de7569aad9557e1e1a5018e4ec544437be6cf8bd787271c437b187dc7a
SSDEEP

24576:CUHw0+DSANpEIoIfJ/zwYuiYilpg7Au6tejBygfce7eaeb57DsK:z+GAzEX2sYuiYQTuQejBL3T457p

Score

4^/10

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe
File opened for modification	C:\Windows\WindowsUpdate.log	wusa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 872	896	rundll32.exe	27
PID 896 wrote to memory of 872	896	rundll32.exe	27
PID 896 wrote to memory of 872	896	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1def09ddf41a8c834f3d459889d2e48690a33b40e3bd5d403c5eb94ec84a8cee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\wusa.exe
  "C:\Windows\system32\wusa.exe" "C:\Windows\Temp\WDFFFE2.tmp\Microsoft User-Mode Driver Framework Install-v1.7-Vista.msu" /quiet /norestart
  2⤵
  - Drops file in Windows directory
  PID:872

C:\Windows\Temp\WDFFFE2.tmp\Microsoft User-Mode Driver Framework Install-v1.7-Vista.msu

Filesize
498KB

MD5
8ff6427fb39d1390898778ce78596d69

SHA1
e710244415d542c539bfc4b5a594db639ab2b75d

SHA256
2547c0a41d667b0caf5410bcc7f5e33e7fc41e250f47a2389856f56793104080

SHA512
6c883a1a60f7892679374a5b8280fac04bdb837aa1997ec7834b01468954bd60d64a4fe0bc53c643cf73b7370ca715875a7388e78a27530f16511d5d40781bda

Download Submit
memory/872-55-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download