5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 15:02

Target
DamFirefox/components2/DamMz26.dll
Size 25KB
Sample240321-sep6eaeb39
SHA256 39d3ba2cbb33c5c17e4152060cf0da06d931384ea9f9886ba753064187abf695
MD5 54226a2afce74522824fa6bf50bf9be8
SHA1 4204a619f975d4f3140c3a438794bde498c4ec0c
SHA512 6efd6ab10940f0b37b859d2e5143966c6485aafc117e67e6728620446494a6880d44b626445d03ce0b50ab2993688b9fc4f56430ed5da1608aa190b22b0fdbed
SSDEEP 384:JM86ZdsRJnsKhYnK4HfjSP8Si6rSEPDpvP3educUUGtJnuNRgI3gQOZXOPVTFI/s:JyfjKbvxZneRZOZXOdBI/s
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4636	2068	rundll32.exe	95
PID 2068 wrote to memory of 4636	2068	rundll32.exe	95
PID 2068 wrote to memory of 4636	2068	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz26.dll,#1
  2⤵
  PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3744