5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52

Analysis

max time kernel
110s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 15:02

Target
DamFirefox/components2/DamMz.dll
Size 88KB
Sample240321-sep6eaeb39
SHA256 28cb7431134c936aa718a1eb8d1a4d1c024819ba4ccd31cc8fc00597182a14b2
MD5 7f5c21afbcee02b57851a101c0c308de
SHA1 353aebccb24988942ebee69c847fc255d72e046a
SHA512 7d3ba4d0b487366f21d174a02533b9132108dd296661e043beb6b90ef1afd5ec4653543e09e2c0d57d05973737745741619908e3a3cd90cafa1d31cee07f0b43
SSDEEP 1536:V7lCwCmNHkkt16U3+20m96SSH3iFRBA/:VBzhZ420m96XyFRG/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 5052	456	rundll32.exe	85
PID 456 wrote to memory of 5052	456	rundll32.exe	85
PID 456 wrote to memory of 5052	456	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz.dll,#1
  2⤵
  PID:5052