23c9560ad4ef053fe507287711e6894c3bd12ef7cf42ebc14597c9b62939b95d

Resubmissions

11/05/2023, 18:26

11/05/2023, 18:18

max time kernel
143s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 18:26

Target

OneShot.v27.03.2017/libgcc_s_sjlj-1.dll
Size

529KB
MD5

9d67f52faca138be698cffaeea161fc5
SHA1

205d94040be6f3b8683e3e8babeeaa538e5bf63e
SHA256

2b2926f0c27cca16335621ad3d9ce2f589b61dae41fb7651c6ba98596ec30f25
SHA512

8378ce8f95395f1d2abd272c8410d1d24d05c9e45e5f1e071dde3a7c324426cc54333da4302d6690460df37db504e2296c940d7982e6764241c7517ceb8da43e
SSDEEP

3072:yzd+UZzONIX26oS9AK0bCBEBNPvZgo4r8j7O6P5i6iv9jvUXksm4sLRSKJP8PWY7:CRVuK02eZp7O6hOOLQIKJk+/XGan3KN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1176	1364	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1356 wrote to memory of 1364	1356	rundll32.exe	28
PID 1364 wrote to memory of 1176	1364	rundll32.exe	29
PID 1364 wrote to memory of 1176	1364	rundll32.exe	29
PID 1364 wrote to memory of 1176	1364	rundll32.exe	29
PID 1364 wrote to memory of 1176	1364	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OneShot.v27.03.2017\libgcc_s_sjlj-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\OneShot.v27.03.2017\libgcc_s_sjlj-1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 228
    3⤵
    - Program crash
    PID:1176

memory/1364-54-0x000000006D0C0000-0x000000006D13A000-memory.dmp

Filesize
488KB

Download