b92b4f05ced0a9d216725f0d4e1faf7ff850b834e0f1ffa1d79423ee071d92cc | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 15:34

Sharing

Report Analysis Logs

General

Target

Plugins/Gracenote/CddbFEX.dll
Size

637KB
MD5

83f8518c94173bce437fc9b8b7876bf9
SHA1

859503baf5c127527ba9c9e9fca43e31b0d4d87b
SHA256

6a3a5ea50b2be2eb9787d82758625f165f0efc80d9ba0e4d7f2f00a90ce43e66
SHA512

bd29045566e6717ff003b6a4f77f1580b2cee5ba2350fd654b546147fd8e74ad1077776e6a90328490dda32b911234412dffef30bf40ebcf2352d0fdcd354369
SSDEEP

12288:z8qBozD29L+00kIFxWMMNykyoyPYsM99xa:zfozD29q0IFoMjYsP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CddbFEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CddbFEX.dll,#1
  2⤵
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads