Analysis

  • max time kernel
    144s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 17:02

General

  • Target

    openvdb.dll

  • Size

    2.3MB

  • MD5

    b5f8f4ff9e4e1daeeaf58ccc4efdc2e6

  • SHA1

    54e826f10e1e85a89ae38ad6a5448ab16048b6a0

  • SHA256

    ddafc5a9ad718305c1f448481af7225282c51d75b5c38859ceef8f86038f499d

  • SHA512

    850ea8693bb7f61a823bcfbb32ac73de6307d336267ca7e85ed693ebb041e7201e176a4b849b946b0583218191e908b5a5949dcfaf96da0666368ac50b679e89

  • SSDEEP

    49152:DoLu0ypHuQAuGQRimVzbrZWk6UndnyQBo2mxL9Oe9Fbt+m/r7fDsxJTGQ+0g:rZimVzbrZWk6UndyQCDH

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvdb.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\openvdb.dll,#1
      2⤵
        PID:5012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 616
          3⤵
          • Program crash
          PID:624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5012 -ip 5012
      1⤵
        PID:1284

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads