fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6

Analysis

max time kernel
87s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:40

Target

res/driver/google/win10/i386/WUDFUpdate_01009.dll
Size

1.8MB
MD5

bdefa06b2ca73b4506e9b8814c64d054
SHA1

6d6639b23e42558c551e23bbadd2805b5d11cc5c
SHA256

b6fdcb4dfbea5fb0271e6d9bf85b5f5d3ea0a0a33df8c016681b17ca18ec2c1e
SHA512

51628f179d76802e6f926dfc5023a48facb3dca9a63994c289bb69da21516c5464c13ebe3e3c79607f7a0f346fdebef39338a67a02f883d71e5411c04648823d
SSDEEP

49152:8HAPbyCYhUJodNcmvwwoaehBUfrQHtmr8UQmB:EWyCYhUJ0cYoa0+TQHYr6mB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3188	2040	rundll32.exe	77
PID 2040 wrote to memory of 3188	2040	rundll32.exe	77
PID 2040 wrote to memory of 3188	2040	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\driver\google\win10\i386\WUDFUpdate_01009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\driver\google\win10\i386\WUDFUpdate_01009.dll,#1
  2⤵
  PID:3188