b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
4s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/10/2022, 03:44

Target

Data/xulrunner/mozalloc.dll
Size

8KB
MD5

28fdc2242a580ea172af94420819e762
SHA1

809d8ed8c4a548472cfc7a994cfdcc6a3c1fddc7
SHA256

295a4b5eeb36e0ed8d44c420d7b60647df361b6201a972c8b3fffc1eec39e9eb
SHA512

7c403db5d094721dcce0367106e2860b313e979162a793240cb0acff542c25493c628a310f8bb9ffe24ca000bfb9373ec9f8be030f92d276a344aad554a169a2
SSDEEP

192:jdO29/1iNxwy0Z3lXkxdl3XdlIyWwxDGA+Y:029Q0Vl0x/NDNVGAj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1792	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 864 wrote to memory of 1792	864	rundll32.exe	28
PID 1792 wrote to memory of 1780	1792	rundll32.exe	29
PID 1792 wrote to memory of 1780	1792	rundll32.exe	29
PID 1792 wrote to memory of 1780	1792	rundll32.exe	29
PID 1792 wrote to memory of 1780	1792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozalloc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozalloc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 224
    3⤵
    - Program crash
    PID:1780

memory/1792-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download