2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
291s
max time network
319s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libjpeg-9.dll
Size

1.1MB
MD5

5f9af6a09cdbbeca6f9d8aace67e0bca
SHA1

abb9b6edf731e1c4185e3f615026da746022eaf3
SHA256

7be167f47c9e53907384f130fd656884947cf76a45633aa083c87e1c0d266619
SHA512

04aae19d7445ca90415927954f6a35337da7b7f888827b0ce2b153a28fba2037b9104bab3bd823de4b4783cc8fb3d32c747468f81d32b66baecbb3dc84e57c9a
SSDEEP

12288:XOjapT/JQx2AfOx+i/lzhIQG9DQ7gl5SWUqLQy1n5BrLj3GyA82kiu8lmYnwkjTY:XOjapl1AfOsf9AA3zA82Rulgwkul

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 1892 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1712	1892	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1892	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1892	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1892	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libjpeg-9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libjpeg-9.dll,#1
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 616
    3⤵
    - Program crash
    PID:1712

memory/1892-121-0x0000000069C00000-0x0000000069D23000-memory.dmp

Filesize
1.1MB

Download