b92b4f05ced0a9d216725f0d4e1faf7ff850b834e0f1ffa1d79423ee071d92cc | Triage

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 15:34

Sharing

Report Analysis Logs

General

Target

Plugins/Gracenote/CddbFEX.dll
Size

637KB
MD5

83f8518c94173bce437fc9b8b7876bf9
SHA1

859503baf5c127527ba9c9e9fca43e31b0d4d87b
SHA256

6a3a5ea50b2be2eb9787d82758625f165f0efc80d9ba0e4d7f2f00a90ce43e66
SHA512

bd29045566e6717ff003b6a4f77f1580b2cee5ba2350fd654b546147fd8e74ad1077776e6a90328490dda32b911234412dffef30bf40ebcf2352d0fdcd354369
SSDEEP

12288:z8qBozD29L+00kIFxWMMNykyoyPYsM99xa:zfozD29q0IFoMjYsP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3224	3764	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 3764	724	rundll32.exe	85
PID 724 wrote to memory of 3764	724	rundll32.exe	85
PID 724 wrote to memory of 3764	724	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CddbFEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CddbFEX.dll,#1
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 612
    3⤵
    - Program crash
    PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3764 -ip 3764
1⤵
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads