2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
297s
max time network
322s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libfreetype-6.dll
Size

2.6MB
MD5

1ea3d7ba73ca7d599ea12f35e4bc992b
SHA1

5898b48f33dd638a624ac704326ac32fe259761b
SHA256

1a4c5d51f06ce4279b3e7afcf2554461bf6b9a98277d3baa7d9b7561d0219fbc
SHA512

7661fb532115e1b969bd87e6fe0b460804921f27cc8f4df31a8248ca9568485fcf4bc22a218375d0e37e7375b4a48884d2b8876e952c85de336115060cd57ea8
SSDEEP

49152:U1IPjJMa9G6TOSiRUoFHGYPXiGAOa/QEiIOh3c/t76KNmheKkvMvDdZRxQ5B06oe:U10Ma98SiRUoFHGYPXiGAOa/QEiIOh30

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3644 980 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3644	980	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4996 wrote to memory of 980	4996	rundll32.exe	rundll32.exe
PID 4996 wrote to memory of 980	4996	rundll32.exe	rundll32.exe
PID 4996 wrote to memory of 980	4996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libfreetype-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libfreetype-6.dll,#1
  2⤵
  PID:980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 676
    3⤵
    - Program crash
    PID:3644

memory/980-117-0x0000000004AA0000-0x0000000004E24000-memory.dmp

Filesize
3.5MB

Download
memory/980-119-0x0000000067680000-0x000000006790D000-memory.dmp

Filesize
2.6MB

Download
memory/980-120-0x0000000061980000-0x00000000619C2000-memory.dmp

Filesize
264KB

Download
memory/980-121-0x0000000068D40000-0x0000000068E1B000-memory.dmp

Filesize
876KB

Download
memory/980-122-0x0000000063080000-0x00000000630A1000-memory.dmp

Filesize
132KB

Download
memory/980-123-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download
memory/980-124-0x0000000004AA0000-0x0000000004E24000-memory.dmp

Filesize
3.5MB

Download
memory/980-125-0x00000000687C0000-0x0000000068AEC000-memory.dmp

Filesize
3.2MB

Download
memory/980-126-0x0000000061EC0000-0x0000000061F45000-memory.dmp

Filesize
532KB

Download
memory/980-127-0x0000000066200000-0x0000000066343000-memory.dmp

Filesize
1.3MB

Download
memory/980-128-0x0000000069340000-0x00000000693F0000-memory.dmp

Filesize
704KB

Download