07aaa42b737976c65e566acb0ddce375a99322457fad9469ff6f007139dc7fa9 | Triage

Analysis

max time kernel
3s
max time network
58s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 00:27

Sharing

Report Analysis Logs

General

Target

Cddb.dll
Size

64KB
MD5

2451d898acbc06f5ab1619f603f43121
SHA1

7c9a6a577c7aa721aeb423564107710167900e78
SHA256

26805ae4c29903fd6915652298848e1c8096d4f346db5d77e0b38f5e0b9c4e0e
SHA512

cc592a9d973ca28c93942c0d1b7bc08842e36b38e004347c28869dca9e95f860b30fcf86414ca930566cd8a569067f00649a17dc4d5f471896510d3600798e98
SSDEEP

1536:pqcjV+rpbc9pAdpHpuG/4l7cEYT/0gxq:0pHcPYEYT/04q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28
PID 1104 wrote to memory of 972	1104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cddb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cddb.dll,#1
  2⤵
  PID:972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download