b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 03:44

Target

Data/xulrunner/libGLESv2.dll
Size

624KB
MD5

eabe78b9c8bead00f0b276a5985f36b4
SHA1

96ad200100fcc89b1360ab36cf54911055a92906
SHA256

8afd1a202701b65a8d072b8d5585daa2534f3624f3b20e125a0b0a987b4f0fb8
SHA512

63641ced25f6b8c7eaa55c5142d6528ec741b2eb972c2c1db15b0b8762221555b77440b4b2ec593b33d9bf57fa70ff0592962f096a5f914eb24d57a3f04dab8c
SSDEEP

12288:ZVe76nZKX/mwHDUEFrIufqprT6+3g1Mr6n6xCpf4y0nqaIViBX:hnEuN+Ag1Mu64pf4y0nqaIM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libGLESv2.dll,#1
  2⤵
  PID:540

memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download