b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0 | Triage

Analysis

max time kernel
11s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Data/xulrunner/libEGL.dll
Size

44KB
MD5

d22059b7c7b1d32c28aa4350a9bf282d
SHA1

b710de9ee6e10e2443cc76da4b8e89c784962bc5
SHA256

6da2826918cd77a4eb1add01b05f1e22da04528987b2b6125ad2308db1e33ac4
SHA512

4e0158f95b30045617e33cc9b2c9b6efd55c62e5d8e7f692bd426125b823f7db195b6603cf7adf63b721bc5ed572e52612205aee59fc3bd2088e8030a3c81715
SSDEEP

768:pvqRKREY0+i5OR6Jiy1TBNpK+haEF+FlGAuZOfGKUDG:pvqRKREY0+pEJiYN+EF+/GDOfGKU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3392	3872	rundll32.exe	84
PID 3872 wrote to memory of 3392	3872	rundll32.exe	84
PID 3872 wrote to memory of 3392	3872	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libEGL.dll,#1
  2⤵
  PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads