2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
275s
max time network
319s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libharfbuzz-0.dll
Size

3.6MB
MD5

526a6ba24cb4106ee6da8978ed6c829b
SHA1

6c134e115c53e4ca82f0d8ca1c0d9df3ba3d5d32
SHA256

70acb0a29344c85e031f811c4391fa70b1a88c97e01a2b5b02bbe665b24e9450
SHA512

621aae21d4f02773e47803d7ab1ff729b9856cfdb09dc92423a11f8059d43d1d0c23002dfd1ad36a5436789905834e73ad1570d5c9e93cddb82bd70dee9e0888
SSDEEP

24576:k//SLO1N7g6I3Hyt2tvH3/Fure8S1gjB/tRX/MMT4p+pX9iJhXYNM87g+XU7uiJr:i/SLAg6I9/FoeI/4spXYXYm08

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5084 wrote to memory of 5108	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 5108	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 5108	5084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libharfbuzz-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libharfbuzz-0.dll,#1
2⤵
PID:5108

memory/5108-116-0x0000000004860000-0x00000000048A2000-memory.dmp

Filesize
264KB

Download