b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
14s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 03:44

Target

Data/xulrunner/libGLESv2.dll
Size

624KB
MD5

eabe78b9c8bead00f0b276a5985f36b4
SHA1

96ad200100fcc89b1360ab36cf54911055a92906
SHA256

8afd1a202701b65a8d072b8d5585daa2534f3624f3b20e125a0b0a987b4f0fb8
SHA512

63641ced25f6b8c7eaa55c5142d6528ec741b2eb972c2c1db15b0b8762221555b77440b4b2ec593b33d9bf57fa70ff0592962f096a5f914eb24d57a3f04dab8c
SSDEEP

12288:ZVe76nZKX/mwHDUEFrIufqprT6+3g1Mr6n6xCpf4y0nqaIViBX:hnEuN+Ag1Mu64pf4y0nqaIM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 816	2216	rundll32.exe	81
PID 2216 wrote to memory of 816	2216	rundll32.exe	81
PID 2216 wrote to memory of 816	2216	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\libGLESv2.dll,#1
  2⤵
  PID:816