2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
292s
max time network
321s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libboost_program_options-mt.dll
Size

787KB
MD5

810221238b6ded4a033de5dbb1fb399c
SHA1

45aa75e0e1fb9055e288ebb0dee847bbe7888bdb
SHA256

90a5ee4e4deb34ed999e7930332bbf9570b3c2f1edc01efb0805b292cb9b6dc1
SHA512

5b8a2750c46838eb8cc75d5bb8426f425535d659564dfa4fe558ae6fc0af31c7d6e874ada11b2425a903c4af7be7ab57cd29fa22e345230c0c2282b7215c96b8
SSDEEP

12288:IRWEoeOSDM44RVfrbfxQw3E3Lhz11noxt+RfB:IRWEoeOSDM4WVnfxQw3E3LhTnoxtSfB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1736 1436 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1736	1436	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1436	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1436	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1436	1264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libboost_program_options-mt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libboost_program_options-mt.dll,#1
2⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 632
3⤵
- Program crash
PID:1736

memory/1436-121-0x000000006FAC0000-0x000000006FB33000-memory.dmp

Filesize
460KB

Download
memory/1436-122-0x000000006FAC0000-0x000000006FB33000-memory.dmp

Filesize
460KB

Download
memory/1436-123-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download
memory/1436-124-0x000000006FE40000-0x00000000703DF000-memory.dmp

Filesize
5.6MB

Download