4e2b116b2b07be8dc60364d7f67855815d3761ca853809752eeed3e21b84799b

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 10:24

Target

Samples/mozglue.dll
Size

644KB
MD5

7dadffc65c83066fcf6874dbf05f7d18
SHA1

213495c8b23401613f393698d2eeaba662c8493b
SHA256

2e5f5e3d3fd62438750c0f0287a547bdb07ee47389cf0cc28374316f94a033ac
SHA512

9e16a0aadf05631e0a4b858e3854941dec8e8c7feb8fe2f198871df76857f2f6a6f4476875cae826e72167dedba7f72d6a81f20935d24263462e6646046e7a5e
SSDEEP

12288:wN2C8jeLkfyuHRpeNrZFDQjePSA9RJQrojvkNmSJZuRfpY160gh3he0:IjieWpurSa6Mv4mSJZuRfa60gh3w0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28
PID 1628 wrote to memory of 1212	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\mozglue.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\mozglue.dll,#1
  2⤵
  PID:1212