bd2faa8a9ca4d85a7330872c8b071ddca95d0e199d33bfffb1464caa0f34bb3b | Triage

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2023, 19:24

Sharing

Report Analysis Logs

General

Target

libtheora.dll
Size

170KB
MD5

c6018d83ea9077e26812acc25ef933ef
SHA1

b9c6b91112ab849feab40372945d8090a6038be4
SHA256

cb9a9eba0aa0de4f0e5675e3a1d7eca17fcfe0610aed0f946f574c5b63ca4030
SHA512

c6e35c2ba30c101655fbd314a8c1bbd795873452ce6e1916e6fc02094de882c87ac77d5f27e58bfe3cb9562a55d9142a83dd6d9ed1b4f8328081c8ed5f771cbb
SSDEEP

3072:XF/0QZz0d2I3xxz1N01cgVRX5OYnZNxVhN2NXQN+8vLK5892Z:1JZz0dlx50igtZN5s5QEsLG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4536	2452	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2452	1668	rundll32.exe	84
PID 1668 wrote to memory of 2452	1668	rundll32.exe	84
PID 1668 wrote to memory of 2452	1668	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libtheora.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libtheora.dll,#1
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 604
    3⤵
    - Program crash
    PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2452 -ip 2452
1⤵
PID:3808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads