f07f6044bbe87080fd9a49ff5b8929edb42ec1e7d0c7bdb1d4ec6b22ca197010 | Triage

Analysis

max time kernel
136s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:59

Sharing

Report Analysis Logs

General

Target

CDM 2.00.00/FTLang.dll
Size

100KB
MD5

cdf91fb3cf82d2a5682c42714d8cb9c2
SHA1

749ce7db573f421bc520786e17ca0efa26822d81
SHA256

3392bf2a67f3774b58332fd1e45a3bddf87ca25edc3c40ef0c266f15e962114f
SHA512

f826acad305155b489b5403f04f6348bdec1c88c9798c871681cc1e7a5f3451a8cb4275d1b6055108d71c9947861d55fb08789016f39aed99728ad3f2c268f25
SSDEEP

1536:sGfTyQH+NKv4Z8Li60BXNiWh8vgtVcIUG:syx+CLiJXNiRvgtVbUG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 676	2704	rundll32.exe	86
PID 2704 wrote to memory of 676	2704	rundll32.exe	86
PID 2704 wrote to memory of 676	2704	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\FTLang.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\FTLang.dll",#1
  2⤵
  PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads