b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
9s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 03:44

Target
Data/xulrunner/mozglue.dll
Size 132KB
Sample221024-eaqz9aedcn
SHA256 31afaa8fc17b06ad0f4b7ffc1698276e9bfe7f55b3b6ff58275a6e9c5f6bdc54
MD5 f3d7b45387c316c596ca24f9adc841a4
SHA1 ab1d668da202d3dd3d2464f49c2c582e67d7a475
SHA512 0b1239415737dd896d492686752340fc02843bbfb284e5bd5c2e59e3f762229dc55237bc1961d39eba8a6a262a7cdccf45908b044f9d52512b8e08b436e30468
SSDEEP 3072:3xUlakCRCzblf9p+wW3SGenVlmew6wsubo5ZwTBfompPpROZq2JJPTy:izJ+PCfEKwsuKwTBgmpvOZq2JJPT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	4508	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4508	1220	rundll32.exe	83
PID 1220 wrote to memory of 4508	1220	rundll32.exe	83
PID 1220 wrote to memory of 4508	1220	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozglue.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozglue.dll,#1
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 604
    3⤵
    - Program crash
    PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4508 -ip 4508
1⤵
PID:2268