f07f6044bbe87080fd9a49ff5b8929edb42ec1e7d0c7bdb1d4ec6b22ca197010

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 13:59

Target

CDM 2.00.00/ftserui2.dll
Size

32KB
MD5

1452ce75a9ac31d29d552f3bcd62e64e
SHA1

9c55824bd4f8bd46d05388b017113201de6f5a1d
SHA256

e49ba33c49c921322c807d0ef21815cff0af3fc32c269c9f4cf32d57705b9c62
SHA512

36d64f5250d167722cbf69f6259d87d04067ff3a779f7a4d8686a8566d7373e824a51933378d3dfca65cb341e6a096d9758c64cc17ceaafed4c7a6a870c19161
SSDEEP

384:1bL6rJ9kE/hXnlsg8DiIYX8gJtckZqUS6lrdeOW9OqN9PWyWCtoxsQwM48KQYdMh:IPXegUix/plAX1W9fohXJ2/r2+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28
PID 2056 wrote to memory of 2680	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\ftserui2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CDM 2.00.00\ftserui2.dll",#1
  2⤵
  PID:2680