b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0 | Triage

Analysis

max time kernel
8s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 03:44

Sharing

Report Analysis Logs

General

Target

Data/xulrunner/breakpadinjector.dll
Size

65KB
MD5

2a38733e2fe7721c18ef1637150c201c
SHA1

62dd6c16dd34282eff0462c202f9a6f14a77250b
SHA256

dc4f8e4832098a970ac719dcea3aa64ebee3995e0742933b64f388f613d5fb15
SHA512

ea7eed661e9aa061a3c7b1a6bae9961cacf6e57f684b083b0a6344b76039c6da8d5f458e5eb82a8520e3081dbef8323350451656f186740cff827006475a939d
SSDEEP

1536:FJnTSCeCSkCqloXmesOd19RkpoePjhWkd9zQ:FJnAXB9soehWkd9U

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	4744	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4744	4720	rundll32.exe	82
PID 4720 wrote to memory of 4744	4720	rundll32.exe	82
PID 4720 wrote to memory of 4744	4720	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\breakpadinjector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\breakpadinjector.dll,#1
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 560
    3⤵
    - Program crash
    PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4744 -ip 4744
1⤵
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads