b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 03:44

Target

Data/xulrunner/mozglue.dll
Size

132KB
MD5

f3d7b45387c316c596ca24f9adc841a4
SHA1

ab1d668da202d3dd3d2464f49c2c582e67d7a475
SHA256

31afaa8fc17b06ad0f4b7ffc1698276e9bfe7f55b3b6ff58275a6e9c5f6bdc54
SHA512

0b1239415737dd896d492686752340fc02843bbfb284e5bd5c2e59e3f762229dc55237bc1961d39eba8a6a262a7cdccf45908b044f9d52512b8e08b436e30468
SSDEEP

3072:3xUlakCRCzblf9p+wW3SGenVlmew6wsubo5ZwTBfompPpROZq2JJPTy:izJ+PCfEKwsuKwTBgmpvOZq2JJPT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	1036	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1036 wrote to memory of 968	1036	rundll32.exe	28
PID 1036 wrote to memory of 968	1036	rundll32.exe	28
PID 1036 wrote to memory of 968	1036	rundll32.exe	28
PID 1036 wrote to memory of 968	1036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozglue.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozglue.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 224
    3⤵
    - Program crash
    PID:968

memory/1036-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download