Analysis

  • max time kernel
    294s
  • max time network
    318s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    02-04-2023 17:50

General

  • Target

    Oneshot/libsigc-2.0-0.dll

  • Size

    227KB

  • MD5

    4ee446b09c490796662c13a01d5fcd1c

  • SHA1

    969c11adffc32f5836cc5ceba21c4aa22bb71047

  • SHA256

    35d3d4b55d14c2efd8340bda4650110f0774116e5d8879551c0ff78323829bf5

  • SHA512

    9a9b6b57c8ca11ed47522616dbd25f54a3226a2c8335bde821d0c341bf7273bf2537515813bdb47762e37a5204f4c8199267336c20ae77826bf1059f91c579fe

  • SSDEEP

    3072:RvIGRYNdyhWKvEMqEax4GdHW+rmV6jUJmG7swMfUjcdPpoonTmOGPsRg1v6tAyuj:mLmV6jUJmoSVAyG

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libsigc-2.0-0.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libsigc-2.0-0.dll,#1
      2⤵
        PID:4884
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 632
          3⤵
          • Program crash
          PID:2328

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4884-120-0x000000006D0C0000-0x000000006D13A000-memory.dmp
      Filesize

      488KB

    • memory/4884-119-0x000000006AC00000-0x000000006AC3B000-memory.dmp
      Filesize

      236KB

    • memory/4884-121-0x000000006FE40000-0x00000000703DF000-memory.dmp
      Filesize

      5.6MB