b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
26s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 03:44

Target
Data/xulrunner/mozjs.dll
Size 3.2MB
Sample221024-eaqz9aedcn
SHA256 a97915d60a7919221a7608af09d2ade1c226e6c73fd66f65e1420be431e9b8da
MD5 0270b2224b1e40c0b55679d26822973f
SHA1 eef92b8530e54c12d6b501f27fc0912994b46670
SHA512 6d6c148e877f108cde20629a821ff9b05ce7bc095e88bf9ff592b5df5694d36eda65ffccaf8d557bd386318dd996168f1726b15dc69d027696211254099699ef
SSDEEP 49152:eKSr5E1VNygpMDxdiuHSZ2b6sejyF4IsMaiAtliL75UrAOPzK:e9reZ2mssyG1VrA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4564	2700	rundll32.exe	80
PID 2700 wrote to memory of 4564	2700	rundll32.exe	80
PID 2700 wrote to memory of 4564	2700	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozjs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozjs.dll,#1
  2⤵
  PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 4564
1⤵
PID:2376