Analysis

  • max time kernel
    297s
  • max time network
    322s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    02-04-2023 17:50

General

  • Target

    Oneshot/libfreetype-6.dll

  • Size

    2.6MB

  • MD5

    1ea3d7ba73ca7d599ea12f35e4bc992b

  • SHA1

    5898b48f33dd638a624ac704326ac32fe259761b

  • SHA256

    1a4c5d51f06ce4279b3e7afcf2554461bf6b9a98277d3baa7d9b7561d0219fbc

  • SHA512

    7661fb532115e1b969bd87e6fe0b460804921f27cc8f4df31a8248ca9568485fcf4bc22a218375d0e37e7375b4a48884d2b8876e952c85de336115060cd57ea8

  • SSDEEP

    49152:U1IPjJMa9G6TOSiRUoFHGYPXiGAOa/QEiIOh3c/t76KNmheKkvMvDdZRxQ5B06oe:U10Ma98SiRUoFHGYPXiGAOa/QEiIOh30

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libfreetype-6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libfreetype-6.dll,#1
      2⤵
        PID:980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 676
          3⤵
          • Program crash
          PID:3644

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/980-117-0x0000000004AA0000-0x0000000004E24000-memory.dmp
      Filesize

      3.5MB

    • memory/980-119-0x0000000067680000-0x000000006790D000-memory.dmp
      Filesize

      2.6MB

    • memory/980-120-0x0000000061980000-0x00000000619C2000-memory.dmp
      Filesize

      264KB

    • memory/980-121-0x0000000068D40000-0x0000000068E1B000-memory.dmp
      Filesize

      876KB

    • memory/980-122-0x0000000063080000-0x00000000630A1000-memory.dmp
      Filesize

      132KB

    • memory/980-123-0x000000006D0C0000-0x000000006D13A000-memory.dmp
      Filesize

      488KB

    • memory/980-124-0x0000000004AA0000-0x0000000004E24000-memory.dmp
      Filesize

      3.5MB

    • memory/980-125-0x00000000687C0000-0x0000000068AEC000-memory.dmp
      Filesize

      3.2MB

    • memory/980-126-0x0000000061EC0000-0x0000000061F45000-memory.dmp
      Filesize

      532KB

    • memory/980-127-0x0000000066200000-0x0000000066343000-memory.dmp
      Filesize

      1.3MB

    • memory/980-128-0x0000000069340000-0x00000000693F0000-memory.dmp
      Filesize

      704KB