14f451b48b16c362c84da734d2874f438642667ff06d1ea628de8856f91f07be | Triage

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 03:59

Sharing

Report Analysis Logs

General

Target

ogg.dll
Size

29KB
MD5

df5ed5803543362e442a53dab6a71aab
SHA1

b40fae87a2beafb2ae374781f433417cf276f569
SHA256

7dbb2d8b390d53c68ae9e9841b75cebac3817f58d28dd47d533543c4158753f9
SHA512

11e49268f7c77114c577b312e1c74399258807b812c8dca6980941ac7ddd259601f01ca571010feacf483dd934334ecb429132b7f7d3753f01b5d1798bb1c8f3
SSDEEP

96:cYc/7r+lyhwRFhWGhlJta9quv2HtZS5IED2q+WUTDMcLrQxXiDG9icgR2pRPbO:cpFsFhW01ag13WUTHLqh9i15

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral6/memory/3432-1-0x0000000074A10000-0x0000000074A82000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	3432	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3432	940	rundll32.exe	91
PID 940 wrote to memory of 3432	940	rundll32.exe	91
PID 940 wrote to memory of 3432	940	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ogg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ogg.dll,#1
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 604
    3⤵
    - Program crash
    PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3432 -ip 3432
1⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3432-0-0x0000000060910000-0x0000000060918000-memory.dmp

Filesize
32KB

Download
memory/3432-1-0x0000000074A10000-0x0000000074A82000-memory.dmp

Filesize
456KB

Download
memory/3432-2-0x0000000060910000-0x0000000060918000-memory.dmp

Filesize
32KB

Download
memory/3432-3-0x0000000074A10000-0x0000000074A82000-memory.dmp

Filesize
456KB

Download