2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4 | Triage

Analysis

max time kernel
293s
max time network
352s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Sharing

Report Analysis Logs

General

Target

Oneshot/libogg-0.dll
Size

127KB
MD5

caab8fe865b5fdc225fca39da7ba0ee3
SHA1

5a15117740458ce486de0c824be133482c4d95d4
SHA256

005a8e03f84b5c3a79a891634b8b338c10d5fae8a77741a0731eb64de124ed5f
SHA512

04e280ae52ffdac57a58c7bf127d3c7bca4eb60cf23f48812e1ff79d6d5cdb7de59c3991dae1f4386e84a1d523bbd5b8e1f36bb4be05ba78fda0c482c0579c64
SSDEEP

1536:jMQ0zKe5x8nl8B7mtX2Va6cYOBYtwjDyI7bLjkNJXk009WygN0X:jMQ+n8lAitX2bk00DgmX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4504 992 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3552 wrote to memory of 992	3552	rundll32.exe	rundll32.exe
PID 3552 wrote to memory of 992	3552	rundll32.exe	rundll32.exe
PID 3552 wrote to memory of 992	3552	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libogg-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libogg-0.dll,#1
2⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 616
3⤵
- Program crash
PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-121-0x0000000070880000-0x00000000708A5000-memory.dmp

Filesize
148KB

Download