f07f6044bbe87080fd9a49ff5b8929edb42ec1e7d0c7bdb1d4ec6b22ca197010 | Triage

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:59

Sharing

Report Analysis Logs

General

Target

CDM 2.00.00/FTLang.dll
Size

100KB
MD5

cdf91fb3cf82d2a5682c42714d8cb9c2
SHA1

749ce7db573f421bc520786e17ca0efa26822d81
SHA256

3392bf2a67f3774b58332fd1e45a3bddf87ca25edc3c40ef0c266f15e962114f
SHA512

f826acad305155b489b5403f04f6348bdec1c88c9798c871681cc1e7a5f3451a8cb4275d1b6055108d71c9947861d55fb08789016f39aed99728ad3f2c268f25
SSDEEP

1536:sGfTyQH+NKv4Z8Li60BXNiWh8vgtVcIUG:syx+CLiJXNiRvgtVbUG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29
PID 2112 wrote to memory of 2628	2112	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\FTLang.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\FTLang.dll",#1
  2⤵
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads