b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0 | Triage

Analysis

max time kernel
5s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 03:44

Sharing

Report Analysis Logs

General

Target

Data/xulrunner/libEGL.dll
Size

44KB
MD5

d22059b7c7b1d32c28aa4350a9bf282d
SHA1

b710de9ee6e10e2443cc76da4b8e89c784962bc5
SHA256

6da2826918cd77a4eb1add01b05f1e22da04528987b2b6125ad2308db1e33ac4
SHA512

4e0158f95b30045617e33cc9b2c9b6efd55c62e5d8e7f692bd426125b823f7db195b6603cf7adf63b721bc5ed572e52612205aee59fc3bd2088e8030a3c81715
SSDEEP

768:pvqRKREY0+i5OR6Jiy1TBNpK+haEF+FlGAuZOfGKUDG:pvqRKREY0+pEJiYN+EF+/GDOfGKU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28
PID 1960 wrote to memory of 1832	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libEGL.dll,#1
  2⤵
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download