Analysis

  • max time kernel
    5s
  • max time network
    7s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 18:37

General

  • Target

    oneshit.dll

  • Size

    10.4MB

  • MD5

    586d49cc240ed5bec59cdd82f251c67a

  • SHA1

    ad5f8240218f32f0df35722d02499a9f8daabba1

  • SHA256

    3171b9fd976b51ee71835c1522465ca208b6085fe29d18c3685cedfdf3cffe2d

  • SHA512

    0fffc93501179b6521a1008296003852fbbda58d7b69449067aea4096596fd4e04580d5b45461c56f58302671b3763444689a11019a42a28e446effc94225247

  • SSDEEP

    196608:IYizgaCkXp16TLIKezmj/wvs/9sL1jcOytIsjTIImELIjHBAHH8Vz1pQVp:YLwLI7mIvbR8y08ImELWA8Vzg

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\oneshit.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\oneshit.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4416-0-0x0000000003920000-0x00000000041E5000-memory.dmp

    Filesize

    8.8MB

  • memory/4416-2-0x0000000003920000-0x00000000041E5000-memory.dmp

    Filesize

    8.8MB

  • memory/4416-3-0x0000000003920000-0x00000000041E5000-memory.dmp

    Filesize

    8.8MB