b902902f414d71f99254b009d971eb2031a06cba1196695adc4568830ccbd9b0 | Triage

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 03:44

Sharing

Report Analysis Logs

General

Target

Data/xulrunner/breakpadinjector.dll
Size

65KB
MD5

2a38733e2fe7721c18ef1637150c201c
SHA1

62dd6c16dd34282eff0462c202f9a6f14a77250b
SHA256

dc4f8e4832098a970ac719dcea3aa64ebee3995e0742933b64f388f613d5fb15
SHA512

ea7eed661e9aa061a3c7b1a6bae9961cacf6e57f684b083b0a6344b76039c6da8d5f458e5eb82a8520e3081dbef8323350451656f186740cff827006475a939d
SSDEEP

1536:FJnTSCeCSkCqloXmesOd19RkpoePjhWkd9zQ:FJnAXB9soehWkd9U

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27
PID 2032 wrote to memory of 2016	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\breakpadinjector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\xulrunner\breakpadinjector.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download