2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
294s
max time network
318s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libsigc-2.0-0.dll
Size

227KB
MD5

4ee446b09c490796662c13a01d5fcd1c
SHA1

969c11adffc32f5836cc5ceba21c4aa22bb71047
SHA256

35d3d4b55d14c2efd8340bda4650110f0774116e5d8879551c0ff78323829bf5
SHA512

9a9b6b57c8ca11ed47522616dbd25f54a3226a2c8335bde821d0c341bf7273bf2537515813bdb47762e37a5204f4c8199267336c20ae77826bf1059f91c579fe
SSDEEP

3072:RvIGRYNdyhWKvEMqEax4GdHW+rmV6jUJmG7swMfUjcdPpoonTmOGPsRg1v6tAyuj:mLmV6jUJmoSVAyG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2328 4884 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2328	4884	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4328 wrote to memory of 4884	4328	rundll32.exe	rundll32.exe
PID 4328 wrote to memory of 4884	4328	rundll32.exe	rundll32.exe
PID 4328 wrote to memory of 4884	4328	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libsigc-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libsigc-2.0-0.dll,#1
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 632
    3⤵
    - Program crash
    PID:2328

memory/4884-120-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download
memory/4884-119-0x000000006AC00000-0x000000006AC3B000-memory.dmp

Filesize
236KB

Download
memory/4884-121-0x000000006FE40000-0x00000000703DF000-memory.dmp

Filesize
5.6MB

Download