b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0 | Triage

Analysis

max time kernel
26s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 03:44

Sharing

Report Analysis Logs

General

Target

Data/xulrunner/AccessibleMarshal.dll
Size

11KB
MD5

1226ff69534a9aacffb9c276b1681a43
SHA1

b3feba994b8fb8751fb1fb11f5ca205c87024600
SHA256

77550dbcd8f3cee9c44200df8c5946006a94fee40ceaf2f57b04ecc0f89a75c1
SHA512

2b3cd02e89e3069d77aaf1c464c052388d8b6565084363efb2895ef723a75e708084f378c35cb94e38b856514c1813b01e06a82e8d5b1155a1124e339eed6f3a
SSDEEP

192:2O2jhoVnjdREVU47iS0dt3Xa6SIqAvGQx:2Tji5jdREVfl0DKWGQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3972	2572	regsvr32.exe	79
PID 2572 wrote to memory of 3972	2572	regsvr32.exe	79
PID 2572 wrote to memory of 3972	2572	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\AccessibleMarshal.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\AccessibleMarshal.dll
  2⤵
  PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads