fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6

Analysis

max time kernel
142s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09-03-2024 10:40

Target

res/driver/nvidia/i386/WUDFUpdate_01007.dll
Size

1.2MB
MD5

0c51b0dfd0260c3d543e42ad4ecbe680
SHA1

4c7380d7e618aa62dcc61871c151e8fb8c4af010
SHA256

5c4b244c0ed7d11cb64de766d5aa02f7fede95ca00b680bd03c241b61b302fc8
SHA512

f5b0a451739e8d25f5bd839f2d7066bcae15cf027b98b17bf7b7ee99ec62ae263b9b4eaabf54065fb60c9223241f78650acc526c944d9a872153d72c0151ed14
SSDEEP

24576:nTh6UGedDNvnQOcbrrEdm1zutqI0/TGpJ76UfDGeZgKksizZYyrav6GT:nTh64vQrgA0r6U7GFVPZHray6

Score

4^/10

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	wusa.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	wusa.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2560	3416	rundll32.exe	81
PID 3416 wrote to memory of 2560	3416	rundll32.exe	81
PID 3416 wrote to memory of 2560	3416	rundll32.exe	81
PID 2560 wrote to memory of 2176	2560	rundll32.exe	83
PID 2560 wrote to memory of 2176	2560	rundll32.exe	83
PID 2560 wrote to memory of 2176	2560	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\driver\nvidia\i386\WUDFUpdate_01007.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\driver\nvidia\i386\WUDFUpdate_01007.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\wusa.exe
    "C:\Windows\system32\wusa.exe" "C:\Windows\Temp\WDFF9F0.tmp\Microsoft User-Mode Driver Framework Install-v1.7-Vista.msu" /quiet /norestart
    3⤵
    - Drops file in Windows directory
    PID:2176

C:\Windows\Temp\WDFF9F0.tmp\Microsoft User-Mode Driver Framework Install-v1.7-Vista.msu

Filesize
436KB

MD5
e40ddd6eb4532bffb3260b179e56853b

SHA1
c364cc1894c8f5ede94c28a38647a036ce49a66a

SHA256
b8506218a9b0b86bc8a6b30f50f7340449fe1e35f9d5e7ad7c230596bba5cde0

SHA512
e3b65388b647e8966a211868d5b9d86d6cc6cb24c5201254c324c7aea15e0783349859c88778d65ba0251128ef950b25763c12e550d8fcf3ed15c0c90c884ed2

Download Submit