Analysis

  • max time kernel
    291s
  • max time network
    319s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    02-04-2023 17:50

General

  • Target

    Oneshot/libjpeg-9.dll

  • Size

    1.1MB

  • MD5

    5f9af6a09cdbbeca6f9d8aace67e0bca

  • SHA1

    abb9b6edf731e1c4185e3f615026da746022eaf3

  • SHA256

    7be167f47c9e53907384f130fd656884947cf76a45633aa083c87e1c0d266619

  • SHA512

    04aae19d7445ca90415927954f6a35337da7b7f888827b0ce2b153a28fba2037b9104bab3bd823de4b4783cc8fb3d32c747468f81d32b66baecbb3dc84e57c9a

  • SSDEEP

    12288:XOjapT/JQx2AfOx+i/lzhIQG9DQ7gl5SWUqLQy1n5BrLj3GyA82kiu8lmYnwkjTY:XOjapl1AfOsf9AA3zA82Rulgwkul

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libjpeg-9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libjpeg-9.dll,#1
      2⤵
        PID:1892
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 616
          3⤵
          • Program crash
          PID:1712

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1892-121-0x0000000069C00000-0x0000000069D23000-memory.dmp
      Filesize

      1.1MB