Analysis

  • max time kernel
    121s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2023 14:26

General

  • Target

    VAG K+CAN/VAG K+CAN V3.6/CDM_Setup/FTBUSUI.dll

  • Size

    104KB

  • MD5

    e3974afac60ee2c3ec118d560c7fe98c

  • SHA1

    b6c353060d15d4aa136605cfa1721d1c21efc64d

  • SHA256

    c8e47ba55381bd3df5484a65c4682adf84f694e72b972a0f1c312bac2c0b5dad

  • SHA512

    d9bc13c509a7f753fac04368be146d6bc4f234dfa9a8ccb0f02c96c0f5299041095cc783fda0d9672eca10e7516874af4bd757d09bb72639616f3f3c2c7e3c8a

  • SSDEEP

    1536:oP72a5kDD3OpwYKsFf8LiHuOCJw7IevtW/:Yn546WLijdI6tW

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VAG K+CAN\VAG K+CAN V3.6\CDM_Setup\FTBUSUI.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VAG K+CAN\VAG K+CAN V3.6\CDM_Setup\FTBUSUI.dll",#1
      2⤵
        PID:3048

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads