2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
307s
max time network
319s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libgmp-10.dll
Size

594KB
MD5

f0f28656ed370b0643e825de2458506d
SHA1

d304239a0f384fbe6fcc66a7122f62f3b97adf54
SHA256

a8a99b2b37cc9afd7be06b04faee08698ff4649ec7c3d7dcff21f765e2ee21ec
SHA512

d08326efd216d0c8ad7781644cf265e3679fabe5d3ab155fca9c3339f03af137eea470101f4dc8faf9ad942125a5cd265c062308432cee4f9ec0bce2c6729848
SSDEEP

6144:whYzGB8V57cBNaBWGx/XRUje4Hesx9zTLgq/Tw34XGw1LXjEcZy:IYzG8V57cW1Ee4+sx9zTLgq/Tw3rw53M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1708 4384 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1708	4384	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4544 wrote to memory of 4384	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 4384	4544	rundll32.exe	rundll32.exe
PID 4544 wrote to memory of 4384	4544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libgmp-10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libgmp-10.dll,#1
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 608
    3⤵
    - Program crash
    PID:1708

memory/4384-116-0x000000006AEC0000-0x000000006AF39000-memory.dmp

Filesize
484KB

Download