b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
16s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 03:44

Target

Data/xulrunner/freebl3.dll
Size

290KB
MD5

4120639dffce55f774c2ea5ff8f17c34
SHA1

9474eadb0d27b3c0dfeaf6570101838aab9c3aee
SHA256

5d433de3945cff744ad7aa66a2d84054726f0c881503d3d6690d8d99a535cdf9
SHA512

1e8f7f3553f905d9d8fe7493e51a020656d12e249d25e6173a7ef0e6d60d0f36621f1ffbeb972de23488186d473bf73458281f771f2fbaa012d6b3dd61cfb62f
SSDEEP

6144:yd6rUwW3vYrFhu9es2uzC7IAuBZd3lDSIqChrN9PitdZqqDL6kPXGHrIrYLpg:yKUUF70C7IAuB39TqChrNnqn6oIr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4820	3900	rundll32.exe	80
PID 3900 wrote to memory of 4820	3900	rundll32.exe	80
PID 3900 wrote to memory of 4820	3900	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\freebl3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\freebl3.dll,#1
  2⤵
  PID:4820