fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6

Analysis

max time kernel
144s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:40

Target

res/driver/microsoft/wmfdist11.exe
Size

9.4MB
MD5

a28d243e3de27c0e5516ccf3958c1442
SHA1

6a33348a8b91ad74c4156fc302944e7234408895
SHA256

27d325fce7d68f3af952e16fe67a09fe3f063925318bdc284d3258bd426d37f3
SHA512

07b6b899987d01727c088ee9c5de3a6a9e5990a2dc8803ca53ff7afdf1b7ea6ba9f16cbdc50dc70af641e703679b96979549d43f178d21bd6d3194dc63e99214
SSDEEP

196608:Dtjtc8mAishNIHbePfM+9n+3HGFNetfykuwt0LlJ5Rb94/fHkGqE/:Dtjtc8mAiYPfMa+qAtfBuw+56kGH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2912	update.exe

Loads dropped DLL 2 IoCs

pid	Process
2912	update.exe
2912	update.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setupapi.log	update.exe
File opened for modification	\??\c:\windows\WMFDist11.log	update.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2912	4472	wmfdist11.exe	80
PID 4472 wrote to memory of 2912	4472	wmfdist11.exe	80
PID 4472 wrote to memory of 2912	4472	wmfdist11.exe	80

C:\Users\Admin\AppData\Local\Temp\res\driver\microsoft\wmfdist11.exe
"C:\Users\Admin\AppData\Local\Temp\res\driver\microsoft\wmfdist11.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- \??\c:\9e340d12e573a7980c2578f62fb087\update\update.exe
  c:\9e340d12e573a7980c2578f62fb087\update\update.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2912

C:\9e340d12e573a7980c2578f62fb087\update\update.exe

Filesize
699KB

MD5
0b630c8656b1ea82c82b929d51fa351b

SHA1
2be63bbb8e54a471bbc4bda98c9157903e821be2

SHA256
480bbbbd89d8275bacdd5cfce22d845785de61a1fbee787ebd2f67c54eaf3e21

SHA512
9d804dc534627abc3b7625fe505bfdc6bdb33a23ae46fe6263beb380d92b1dd35b2d1b3a272c87f709413c30f6cd4e6bc271c3ae3ccfb13081679acbe035ebda

Download Submit
\??\c:\9e340d12e573a7980c2578f62fb087\update\UPDSPAPI.dll

Filesize
362KB

MD5
e58ab8bfffc584dba6f7ec2f83f32b68

SHA1
855d7c624feb67140dfbd7f07269eae98b15c23d

SHA256
6d91f37649df6a6f5b180198d495cff9ebfaf264f9867b5d409dfb75ee83587c

SHA512
7fd80646ea082ebe8017797d9ef2910d9e8ff0f7e0be50d708d2d0ea3edc8c4fa95b4f8f7f3c567fce2df586ffa5b0b76e3c5fd14d64f4dc135264d71ff0fa3f

Download Submit
\??\c:\9e340d12e573a7980c2578f62fb087\update\update.inf

Filesize
65KB

MD5
f6f9e25f766ee7eb7f9aa40388877341

SHA1
9c27a182a075ff915b232a3a6351b6bbd5e5495a

SHA256
b3f068d52f7b2c8379801bd0fad36596be9f8fe2477b4be21d74bc8e40cff40a

SHA512
2aeb85d0541837119a8c24986658b95231015de1f1f78143aae17ce5bf489a84af75cf0bf4883fa7cd2c30b471e5b4708afa1812958d019c3e0a51e7f73535d2

Download Submit
memory/2912-107-0x0000000000700000-0x000000000075C000-memory.dmp

Filesize
368KB

Download