a8bc86cd95d9cb31d2a958734e7a88af3eb46bab9a91712a21a7bce6afecde1a | Triage

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2024 08:40

Sharing

Report Analysis Logs

General

Target

MegaMan Unlimited/ogg.dll
Size

52KB
MD5

60ee87ad7427e1a7604f6d492401361c
SHA1

3adce6debcc2dc7a78325495ff6cedf6adf7fe53
SHA256

63ca0400dd0f8485150b5cd6c6ddf783a242918da8eabda9e29368f39c83a413
SHA512

158a276da46764a791328814df781ef34271e44d16e5de98513caa37094c5a001bbf99810bec8854fad1b5d0fad029d684b4d40456114160611ee251e9bf0921
SSDEEP

768:lsZe+T3hUAmNnMpKheTeR9CQcy21K9MjD+IoZ8hxcOy:ls3+wKheTePd2wKOIO8TcOy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4172	4620	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4620	1200	rundll32.exe	84
PID 1200 wrote to memory of 4620	1200	rundll32.exe	84
PID 1200 wrote to memory of 4620	1200	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\ogg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MegaMan Unlimited\ogg.dll",#1
  2⤵
  PID:4620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 600
    3⤵
    - Program crash
    PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4620 -ip 4620
1⤵
PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads