77eff4497232562eeb1862f97d484777202e8ac42c411093a821234045ee61a5 | Triage

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 15:53

Sharing

Report Analysis Logs

General

Target

bin_win32/libvorbisfile.dll
Size

104KB
MD5

522abfcc889293dda2ff79b33f15799d
SHA1

0c02b330d17f660908180b77b1435eda53e5b39a
SHA256

49564cd6facc72d430cd191e7302281143c0122633c8bd2df7a1d077ebeee1fb
SHA512

c8853411c4b1bd144309328d5613beb70da49235730f50abaa1624ffb9c8f88503c026586e97d415d5ab2d231dc27c2547322530df007a592b5f6836631eff3d
SSDEEP

1536:sz0rO3YqoVv0/qGd95vwOeKgncmD73cCUA542bvAQnatsU:lq3Yq6v0iGdTiKHmnzRnats

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	5028	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5028	4868	rundll32.exe	81
PID 4868 wrote to memory of 5028	4868	rundll32.exe	81
PID 4868 wrote to memory of 5028	4868	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin_win32\libvorbisfile.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin_win32\libvorbisfile.dll,#1
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 604
    3⤵
    - Program crash
    PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5028 -ip 5028
1⤵
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5028-0-0x0000000000C30000-0x0000000000C40000-memory.dmp

Filesize
64KB

Download
memory/5028-1-0x0000000002630000-0x0000000002763000-memory.dmp

Filesize
1.2MB

Download