Analysis

  • max time kernel
    149s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2024 23:00

General

  • Target

    OFFICE2016/admin/oct.dll

  • Size

    4.8MB

  • MD5

    218cf4adced2c05d969563cbc483510a

  • SHA1

    8e52ff08de41440218423149d2aad6873295380b

  • SHA256

    cc8e03eb9dd7b89b92b7e60d59478c6a7697e825438290de8aa6acc02bab0174

  • SHA512

    7468e47bb11a64036fa6afb7a1236ca69aa8c203881fecaae5af78fa6d9dd23045911cb24820a3a1318c835656dcd90f586060d453a02925d6b6137c979f68e8

  • SSDEEP

    49152:G1Foq7ClKhuTe6A42iMXwTJMUI/VO/dLZwUziV5T31R1ayMJY4F8OTF+0:G1F+KUe6DIQ/biPcY8

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\OFFICE2016\admin\oct.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\OFFICE2016\admin\oct.dll,#1
      2⤵
        PID:3236
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 716
          3⤵
          • Program crash
          PID:5084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3236 -ip 3236
      1⤵
        PID:1720

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads