f07f6044bbe87080fd9a49ff5b8929edb42ec1e7d0c7bdb1d4ec6b22ca197010 | Triage

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:59

Sharing

Report Analysis Logs

General

Target

CDM 2.00.00/ftcserco.dll
Size

19KB
MD5

d6ca53cccc8ea7d30e36f958a3275696
SHA1

782eef63a8b2f01d05c4bbba68d69a0fb793b90f
SHA256

fef49b86ba6112d2f75db5fcadbbd3a4cf385982549f943b89f134fcee755c71
SHA512

5446a1fe4328f3a9b0915390e73e4d04fe2d4dba5d586018217b62dfb95dd2c404a45b8cb93b8063467ba4e19f7b1f58808314f3de2236f5d89685f0986cf103
SSDEEP

192:Av9Z1zMQNM2eYfcN+re4bCF2XrFKNvB/YMqZu:AvdM8X14+zF+QMqo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28
PID 2520 wrote to memory of 1732	2520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\ftcserco.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\ftcserco.dll",#1
  2⤵
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads