Analysis
- max time kernel
298s - max time network
75s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-es - resource tags
- submitted
23/10/2026, 23:46
General
- Target Oneshot/libfreetype-6.dll
- Size 2.6MB
- Sample261023-3sr72adh38
- SHA256 1a4c5d51f06ce4279b3e7afcf2554461bf6b9a98277d3baa7d9b7561d0219fbc
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libfreetype-6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Oneshot\libfreetype-6.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 6523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3856 -ip 38561⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3856-0-0x00000000022E0000-0x0000000002664000-memory.dmp
memory/3856-2-0x0000000067680000-0x000000006790D000-memory.dmp
memory/3856-6-0x000000006D0C0000-0x000000006D13A000-memory.dmp
memory/3856-11-0x0000000066200000-0x0000000066343000-memory.dmp
memory/3856-10-0x0000000069340000-0x00000000693F0000-memory.dmp
memory/3856-9-0x0000000061EC0000-0x0000000061F45000-memory.dmp
memory/3856-8-0x00000000687C0000-0x0000000068AEC000-memory.dmp
memory/3856-5-0x0000000063080000-0x00000000630A1000-memory.dmp
memory/3856-4-0x0000000068D40000-0x0000000068E1B000-memory.dmp
memory/3856-3-0x0000000061980000-0x00000000619C2000-memory.dmp
memory/3856-7-0x00000000022E0000-0x0000000002664000-memory.dmp