91d41186f44a578c66640f92d2aba74ff13e7cb5eadf899acefedcfe8225c2ff | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 22:34

Sharing

Report Analysis Logs

General

Target

WuaCpuFix64.dll
Size

135KB
MD5

0a04164e4606f8d7a1bb527ae1d23958
SHA1

7735203c0f2ba1e04f99d82ee5911fa8301c1f89
SHA256

91d41186f44a578c66640f92d2aba74ff13e7cb5eadf899acefedcfe8225c2ff
SHA512

f265abb987fed28fcfeca5be0c826136d8a51bec5e203821ea52f01bc57545dba2224578eb94ae9c13aef11e157d080ddd8eb5bba84c8265443b36f11157bd32
SSDEEP

3072:/Awk1bZ2IMZMmXS6PgXQ9dEXgWQVBvFwSqicw9:/AwcI3imQX6a95

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1804	rundll32.exe
1804	rundll32.exe
1804	rundll32.exe
1804	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WuaCpuFix64.dll,#1
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads