2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
310s
max time network
325s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libglib-2.0-0.dll
Size

3.4MB
MD5

ad20c80c07d3189b3af021d5dfbb9fb3
SHA1

f58ca0a1631ca0f70b4dd3aeed00fbbe0628a092
SHA256

210b651df87718744826baefd403390b54b1b65b71dda7134e0c99acd9b11a97
SHA512

e60133f0da5a3072f6ed71f114cebcaeeac1656e96e88a6a1947a24d06ab02ca2dcf7f4fced8db893eca162a167f8803fbf319b47ced98dc787f85905d1768bc
SSDEEP

49152:UtIMeIhQxqXw4QlYpK3jCtv0acWaFCd3fcocuM8tlQ60:UVVhQxqXPQlYANpmK60

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4944 4360 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4944	4360	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3104 wrote to memory of 4360	3104	rundll32.exe	rundll32.exe
PID 3104 wrote to memory of 4360	3104	rundll32.exe	rundll32.exe
PID 3104 wrote to memory of 4360	3104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libglib-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libglib-2.0-0.dll,#1
2⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 668
3⤵
- Program crash
PID:4944

memory/4360-119-0x00000000687C0000-0x0000000068AEC000-memory.dmp

Filesize
3.2MB

Download
memory/4360-120-0x0000000061EC0000-0x0000000061F45000-memory.dmp

Filesize
532KB

Download
memory/4360-122-0x0000000066200000-0x0000000066343000-memory.dmp

Filesize
1.3MB

Download
memory/4360-121-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download
memory/4360-123-0x0000000069340000-0x00000000693F0000-memory.dmp

Filesize
704KB

Download