2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4

Analysis

max time kernel
291s
max time network
323s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Target

Oneshot/libstdc++-6.dll
Size

6.5MB
MD5

bd2bf78da814697f6da9270081bfe965
SHA1

9c91d7efc847518a883f330a1b7ebbb398a0b43e
SHA256

0558a94515c1bc51c3bc5e40b0db6edc0b5f62f7099c3aa3f956e6a199bbbbea
SHA512

1c31fc1ba07326597f431de5a0628ef5ef3a4c7b117bc601a1bffcc138151869687d3a4fca9b7efb1becea4f941519f748a64730acc41c5dd74268df8e44b1ac
SSDEEP

49152:m+R3e+q6a47EQ3Fz/xwtK2h4a161Jo3/OXiQrVyA+sDucrHEaC2bJ8DPcSgdvJOq:mSq6abQA9aNLScrHEal8kvJXNU+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1648 1304 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1648	1304	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1252 wrote to memory of 1304	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1304	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1304	1252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libstdc++-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libstdc++-6.dll,#1
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 632
    3⤵
    - Program crash
    PID:1648

memory/1304-121-0x000000006FE40000-0x00000000703DF000-memory.dmp

Filesize
5.6MB

Download
memory/1304-122-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download