a8bc86cd95d9cb31d2a958734e7a88af3eb46bab9a91712a21a7bce6afecde1a | Triage

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MegaMan Unlimited/libogg-0.dll
Size

23KB
MD5

23465c045b6f6c32104e2b12c69c6250
SHA1

965b6bf596a2375abd2d956a03030bc2846d7f4a
SHA256

f96475cd53f87ea279ed6425aa52a53af8b1d0999c521cd78441bcc9e842d3a1
SHA512

49767f7601b225e4335d8cbf612631e85c96cd4f28d6137bcaabab1a64e265eb202cea7d55fa30f20093948c094f2b047b0a6e2acf58e1fde5245a949a3bf581
SSDEEP

384:QwS9sjuBG7STLNVR+Fm0bIIZTnRPFjx6oO:QwkL8uTLvyFbBBBF9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	4412	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4412	3492	rundll32.exe	84
PID 3492 wrote to memory of 4412	3492	rundll32.exe	84
PID 3492 wrote to memory of 4412	3492	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\libogg-0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\libogg-0.dll",#1
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 600
    3⤵
    - Program crash
    PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4412 -ip 4412
1⤵
PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4412-0-0x0000000070680000-0x000000007068D000-memory.dmp

Filesize
52KB

Download