b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
26s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 03:44

Target
Data/xulrunner/AccessibleMarshal.dll
Size 11KB
Sample221024-eaqz9aedcn
SHA256 77550dbcd8f3cee9c44200df8c5946006a94fee40ceaf2f57b04ecc0f89a75c1
MD5 1226ff69534a9aacffb9c276b1681a43
SHA1 b3feba994b8fb8751fb1fb11f5ca205c87024600
SHA512 2b3cd02e89e3069d77aaf1c464c052388d8b6565084363efb2895ef723a75e708084f378c35cb94e38b856514c1813b01e06a82e8d5b1155a1124e339eed6f3a
SSDEEP 192:2O2jhoVnjdREVU47iS0dt3Xa6SIqAvGQx:2Tji5jdREVfl0DKWGQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3972	2572	regsvr32.exe	79
PID 2572 wrote to memory of 3972	2572	regsvr32.exe	79
PID 2572 wrote to memory of 3972	2572	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\AccessibleMarshal.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\AccessibleMarshal.dll
  2⤵
  PID:3972