2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
292s
max time network
320s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libintl-8.dll
Size

545KB
MD5

0e58cfddd719f305e5b28f4c0ac88e50
SHA1

1cb9698adc4538907a0c4497ac2b26f3ee5ee4ac
SHA256

58e5cfbb1c546027d3aa5aea913a751c8b79da2b17ce08bda02e3871fd1d2b00
SHA512

9ba1d168edc72a107a29e2529d1e8ddfd33782d0a2a8123ca3f6a84d55da2eafc999d678f6c499b1b43002bbc928fdd288378cfa1d5440d9ffa7560309050f79
SSDEEP

6144:BU23KIeYHVGI3k9dBddphT8F/5EWgEyIXdTJtkgOn+9i1hKU+ZF73X/u4:Bvekkek9do/5EWAqtkgfi1hKFvu4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1364 4876 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1364	4876	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 4876	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 4876	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 4876	1656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libintl-8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libintl-8.dll,#1
2⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 624
3⤵
- Program crash
PID:1364

memory/4876-121-0x0000000061EC0000-0x0000000061F45000-memory.dmp

Filesize
532KB

Download
memory/4876-122-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download
memory/4876-123-0x0000000066200000-0x0000000066343000-memory.dmp

Filesize
1.3MB

Download