5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 15:02

Target
DamFirefox/components2/DamMz25.dll
Size 25KB
Sample240321-sep6eaeb39
SHA256 0a28393fb6c9c19ab16aad595f36714fa40039528e1d1f52f56b550b85e7f6f9
MD5 4a234889ef003c0e3bb5821e64c3f6c0
SHA1 d8e5e611b95c5a8fb05c9e2d04f0f66472c3765f
SHA512 62b6b6eb148272a7e6595f7f5aa489587cc0ab75f9d0ca8071331b9a51c46911917a3da6636c290625dff018e5f5e7b90d52a2e2142eddb8cf235bcf005f5dc6
SSDEEP 384:Rj8saJw/JpnGGVgp64HvwGXsSyKuxbAvTpvP3eNgUkGHflkImBBxQOZXOPVgTIgI:RUvwmWCvkpfWP8OZXOd0IgI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz25.dll,#1
  2⤵
  PID:3024