2f2389c4427f79cb94d8d4fb3650b1cf0a27c0fc8996cf9edd061aa8b74fb6c4 | Triage

Analysis

max time kernel
139s
max time network
319s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02-04-2023 17:50

Sharing

Report Analysis Logs

General

Target

Oneshot/SDL2_ttf.dll
Size

169KB
MD5

9e64a15cf488ddd2f4177bd84b4b5dc6
SHA1

e7389e5e0569ef75f3e7523a82af793504e66d32
SHA256

663138ceec1cb121057830917fb76f6a5abfc177640699f8338cc883bb449b17
SHA512

ccb5888550c02b94d3e7e90e754f5f2d1bf7109a82fcf72365f741b304c3c8b00b62511ceb17fae575dc5bd49d8b119fa15e2fbe4199ec473e0df7a6940ea01d
SSDEEP

3072:CxJpLHMXX9/yQ3JmkCymOVEUnDBVNpLTevl7z:2pLHMXAnymO2e1p2vl/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 4876	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 4876	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 4876	1656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\SDL2_ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\SDL2_ttf.dll,#1
2⤵
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-121-0x0000000004370000-0x00000000046F4000-memory.dmp

Filesize
3.5MB

Download