4e2b116b2b07be8dc60364d7f67855815d3761ca853809752eeed3e21b84799b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 10:24

Target

Samples/mozglue.dll
Size

644KB
MD5

7dadffc65c83066fcf6874dbf05f7d18
SHA1

213495c8b23401613f393698d2eeaba662c8493b
SHA256

2e5f5e3d3fd62438750c0f0287a547bdb07ee47389cf0cc28374316f94a033ac
SHA512

9e16a0aadf05631e0a4b858e3854941dec8e8c7feb8fe2f198871df76857f2f6a6f4476875cae826e72167dedba7f72d6a81f20935d24263462e6646046e7a5e
SSDEEP

12288:wN2C8jeLkfyuHRpeNrZFDQjePSA9RJQrojvkNmSJZuRfpY160gh3he0:IjieWpurSa6Mv4mSJZuRfa60gh3w0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3520 860 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3520	860	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3152 wrote to memory of 860	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 860	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 860	3152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\mozglue.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\mozglue.dll,#1
2⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 552
3⤵
- Program crash
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 860 -ip 860
1⤵
PID:2500