23c9560ad4ef053fe507287711e6894c3bd12ef7cf42ebc14597c9b62939b95d

Resubmissions

11/05/2023, 18:26

11/05/2023, 18:18

max time kernel
7s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 18:26

Target

OneShot.v27.03.2017/libharfbuzz-0.dll
Size

3.6MB
MD5

526a6ba24cb4106ee6da8978ed6c829b
SHA1

6c134e115c53e4ca82f0d8ca1c0d9df3ba3d5d32
SHA256

70acb0a29344c85e031f811c4391fa70b1a88c97e01a2b5b02bbe665b24e9450
SHA512

621aae21d4f02773e47803d7ab1ff729b9856cfdb09dc92423a11f8059d43d1d0c23002dfd1ad36a5436789905834e73ad1570d5c9e93cddb82bd70dee9e0888
SSDEEP

24576:k//SLO1N7g6I3Hyt2tvH3/Fure8S1gjB/tRX/MMT4p+pX9iJhXYNM87g+XU7uiJr:i/SLAg6I9/FoeI/4spXYXYm08

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27
PID 1992 wrote to memory of 1164	1992	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OneShot.v27.03.2017\libharfbuzz-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\OneShot.v27.03.2017\libharfbuzz-0.dll,#1
  2⤵
  PID:1164

memory/1164-54-0x00000000001E0000-0x0000000000222000-memory.dmp

Filesize
264KB

Download