72f102fc3d5af3ab0f247faa414fdda6d64280924ecc5717e07d74fa379235a0 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 06:10

Sharing

Report Analysis Logs

General

Target

fpdfsdk.dll
Size

2.8MB
MD5

53fdd251a06c831c3024fd4fa19b50e6
SHA1

4c7f08aba66cadac29931cb3a9674e8b9479c11d
SHA256

72f102fc3d5af3ab0f247faa414fdda6d64280924ecc5717e07d74fa379235a0
SHA512

c5093c90db5dd6c452851ed0f610eadcba5077e3d9bee09a3fbc872031efe59cac657d0035c337f6b5570cc35fb8508863d25ac1abe024a6c085733186996192
SSDEEP

49152:LIulRcUJtRNLNx4LaiPG+JEETg3QEfeoG:LIHMNLlAV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28
PID 2020 wrote to memory of 2488	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fpdfsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fpdfsdk.dll,#1
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads