6bb390bddaaff3e75a6a2b1ecafa3f49bf6e4d93747302a6870698fb26285a32

Analysis

max time kernel
121s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 20:50

Target

driver/win10/i386/WUDFUpdate_01009.dll
Size

1.8MB
MD5

bdefa06b2ca73b4506e9b8814c64d054
SHA1

6d6639b23e42558c551e23bbadd2805b5d11cc5c
SHA256

b6fdcb4dfbea5fb0271e6d9bf85b5f5d3ea0a0a33df8c016681b17ca18ec2c1e
SHA512

51628f179d76802e6f926dfc5023a48facb3dca9a63994c289bb69da21516c5464c13ebe3e3c79607f7a0f346fdebef39338a67a02f883d71e5411c04648823d
SSDEEP

49152:8HAPbyCYhUJodNcmvwwoaehBUfrQHtmr8UQmB:EWyCYhUJ0cYoa0+TQHYr6mB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4572	3692	rundll32.exe	87
PID 3692 wrote to memory of 4572	3692	rundll32.exe	87
PID 3692 wrote to memory of 4572	3692	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\driver\win10\i386\WUDFUpdate_01009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\driver\win10\i386\WUDFUpdate_01009.dll,#1
  2⤵
  PID:4572