025ca9a56a4ab20702dd386fef1d2df311646fb741841cc64d70d37f84468876

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:31

Target

DriverHelper/Setup32/DIFxAPI_x86.dll
Size

315KB
MD5

cf73c3a03582408d422d4f7a01190d00
SHA1

4582875874d066e8975b8a04488422419137fce4
SHA256

dd12d00ca9c9b1013091e733eae021347ba52dcd69173a7e5e4fd80b45ee60f6
SHA512

c3d82121c0535fc819329b8c6e29078f7e71245528658093ed98dd72af8af1200eede951388d938e9b27c049a0874f5cf686a42aa880da34390a72bc1112c8aa
SSDEEP

6144:T3+rEo4fNwSQCT4YNjtMWDnYPWsjfVnnSSNbVQqbySUB:r+rEo4lWYNjJbYtdnpWhS6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1292	2040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverHelper\Setup32\DIFxAPI_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverHelper\Setup32\DIFxAPI_x86.dll,#1
2⤵
PID:1292