b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/10/2022, 03:44

Target
Data/xulrunner/freebl3.dll
Size 290KB
Sample221024-eaqz9aedcn
SHA256 5d433de3945cff744ad7aa66a2d84054726f0c881503d3d6690d8d99a535cdf9
MD5 4120639dffce55f774c2ea5ff8f17c34
SHA1 9474eadb0d27b3c0dfeaf6570101838aab9c3aee
SHA512 1e8f7f3553f905d9d8fe7493e51a020656d12e249d25e6173a7ef0e6d60d0f36621f1ffbeb972de23488186d473bf73458281f771f2fbaa012d6b3dd61cfb62f
SSDEEP 6144:yd6rUwW3vYrFhu9es2uzC7IAuBZd3lDSIqChrN9PitdZqqDL6kPXGHrIrYLpg:yKUUF70C7IAuB39TqChrNnqn6oIr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26
PID 1052 wrote to memory of 1348	1052	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\freebl3.dll,#1
  2⤵
  PID:1348

memory/1348-55-0x0000000076151000-0x0000000076153000-memory.dmp

Download