2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4 | Triage

Analysis

max time kernel
291s
max time network
325s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Sharing

Report Analysis Logs

General

Target

Oneshot/libpixman-1-0.dll
Size

4.6MB
MD5

37059af38aee7c52ac085b81dc4d2b86
SHA1

ba72f6f99c71288cb80b7aa8a31d0211589dd234
SHA256

17f8ae98aa67a3b5d5f05665132ad6bd17a418e76e6c69ce28ef89a6c8b6a5e9
SHA512

3263e87e440d8b49f345f2f8db11cb8cfa68adfd0992261ed6b2fcbb5fc028207eca177ebb67584756a2c617485ff360d3006a13ef83833473624cf583e7d6a5
SSDEEP

49152:fAibSl4iFvMXrMYlDvAW8J38UEcSRzyU6BurNyn2MLn:fFBiFkXrJzf0CWL7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4476 wrote to memory of 5064	4476	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 5064	4476	rundll32.exe	rundll32.exe
PID 4476 wrote to memory of 5064	4476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libpixman-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libpixman-1-0.dll,#1
2⤵
PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...