b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/10/2022, 03:44

Target
Data/xulrunner/breakpadinjector.dll
Size 65KB
Sample221024-eaqz9aedcn
SHA256 dc4f8e4832098a970ac719dcea3aa64ebee3995e0742933b64f388f613d5fb15
MD5 2a38733e2fe7721c18ef1637150c201c
SHA1 62dd6c16dd34282eff0462c202f9a6f14a77250b
SHA512 ea7eed661e9aa061a3c7b1a6bae9961cacf6e57f684b083b0a6344b76039c6da8d5f458e5eb82a8520e3081dbef8323350451656f186740cff827006475a939d
SSDEEP 1536:FJnTSCeCSkCqloXmesOd19RkpoePjhWkd9zQ:FJnAXB9soehWkd9U
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\breakpadinjector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\breakpadinjector.dll,#1
  2⤵
  PID:2016

memory/2016-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download