b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 03:44

Target

Data/xulrunner/freebl3.dll
Size

290KB
MD5

4120639dffce55f774c2ea5ff8f17c34
SHA1

9474eadb0d27b3c0dfeaf6570101838aab9c3aee
SHA256

5d433de3945cff744ad7aa66a2d84054726f0c881503d3d6690d8d99a535cdf9
SHA512

1e8f7f3553f905d9d8fe7493e51a020656d12e249d25e6173a7ef0e6d60d0f36621f1ffbeb972de23488186d473bf73458281f771f2fbaa012d6b3dd61cfb62f
SSDEEP

6144:yd6rUwW3vYrFhu9es2uzC7IAuBZd3lDSIqChrN9PitdZqqDL6kPXGHrIrYLpg:yKUUF70C7IAuB39TqChrNnqn6oIr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\freebl3.dll,#1
  2⤵
  PID:1348

memory/1348-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download