b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0 | Triage

Analysis

max time kernel
26s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 03:44

Sharing

Report Analysis Logs

General

Target

Data/xulrunner/mozjs.dll
Size

3.2MB
MD5

0270b2224b1e40c0b55679d26822973f
SHA1

eef92b8530e54c12d6b501f27fc0912994b46670
SHA256

a97915d60a7919221a7608af09d2ade1c226e6c73fd66f65e1420be431e9b8da
SHA512

6d6c148e877f108cde20629a821ff9b05ce7bc095e88bf9ff592b5df5694d36eda65ffccaf8d557bd386318dd996168f1726b15dc69d027696211254099699ef
SSDEEP

49152:eKSr5E1VNygpMDxdiuHSZ2b6sejyF4IsMaiAtliL75UrAOPzK:e9reZ2mssyG1VrA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4564	2700	rundll32.exe	80
PID 2700 wrote to memory of 4564	2700	rundll32.exe	80
PID 2700 wrote to memory of 4564	2700	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozjs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\mozjs.dll,#1
  2⤵
  PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 4564
1⤵
PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads