f59b9ff344d986ea37b2af26bd6bdf4bba7d004b0f6efd82cfb050dc8b2e94ef | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 10:54

Sharing

Report Analysis Logs

General

Target

Plugins/in_cdda.dll
Size

71KB
MD5

87bf3b10c8df1c53b3ce0182eb56ed26
SHA1

9e8c9ca40799554087e189a04032aeddee0e64fb
SHA256

8ede6d13f9f8d23a42d3b497232fa1921f91ce38e6bb0e7b51304619db576e39
SHA512

2f20125ff6d23b17a510135ba9c31e00cdacd4e621ad9a2ac407edd0f83ab9196e4258b60ec11cf3815681b3748a4e10a9854312155bd7acd61724a75e08de80
SSDEEP

1536:0aNIe7xnyIaEH9OOlZ2JBEtH52c7qrLYQ/jA95LHq5TJPlabfiIW:0CIuyIfwBwHELhLTJPs7a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	3880	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3880	412	rundll32.exe	84
PID 412 wrote to memory of 3880	412	rundll32.exe	84
PID 412 wrote to memory of 3880	412	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\in_cdda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\in_cdda.dll,#1
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 632
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3880 -ip 3880
1⤵
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads