14f451b48b16c362c84da734d2874f438642667ff06d1ea628de8856f91f07be | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 03:59

Sharing

Report Analysis Logs

General

Target

ogg.dll
Size

29KB
MD5

df5ed5803543362e442a53dab6a71aab
SHA1

b40fae87a2beafb2ae374781f433417cf276f569
SHA256

7dbb2d8b390d53c68ae9e9841b75cebac3817f58d28dd47d533543c4158753f9
SHA512

11e49268f7c77114c577b312e1c74399258807b812c8dca6980941ac7ddd259601f01ca571010feacf483dd934334ecb429132b7f7d3753f01b5d1798bb1c8f3
SSDEEP

96:cYc/7r+lyhwRFhWGhlJta9quv2HtZS5IED2q+WUTDMcLrQxXiDG9icgR2pRPbO:cpFsFhW01ag13WUTHLqh9i15

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/1312-1-0x0000000075430000-0x00000000754A2000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	1312	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 1312 wrote to memory of 1888	1312	rundll32.exe	29
PID 1312 wrote to memory of 1888	1312	rundll32.exe	29
PID 1312 wrote to memory of 1888	1312	rundll32.exe	29
PID 1312 wrote to memory of 1888	1312	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ogg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ogg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 228
    3⤵
    - Program crash
    PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-0-0x0000000060910000-0x0000000060918000-memory.dmp

Filesize
32KB

Download
memory/1312-1-0x0000000075430000-0x00000000754A2000-memory.dmp

Filesize
456KB

Download
memory/1312-2-0x0000000060910000-0x0000000060918000-memory.dmp

Filesize
32KB

Download
memory/1312-3-0x0000000075430000-0x00000000754A2000-memory.dmp

Filesize
456KB

Download