5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 15:02

Target
DamFirefox/components2/DamMz27.dll
Size 25KB
Sample240321-sep6eaeb39
SHA256 0611356b149563c75f9779e3e9cd3d0aba67702a7838bd463b93589b8ebcfb80
MD5 34333f3b88330254aba3b32bae10204c
SHA1 a9f6a4eedaea9a1534fdfbba4619177711243be6
SHA512 aac9704c58391e64c65e2c271e85fd689ac3faee0442880e65984b3cbbc31ff3ba2287ae7a4b0a470c17196b0930842007d9a3842bf058abc4c3e46689f41928
SSDEEP 384:6M86ZdsRJnsKhYnK4HfjSP8Si6rSEPDpvP3educUUGtJnuNRjI3gQOZXOPVT0I/s:6yfjKbvxZneR+OZXOdAI/s
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3140	2044	rundll32.exe	89
PID 2044 wrote to memory of 3140	2044	rundll32.exe	89
PID 2044 wrote to memory of 3140	2044	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DamFirefox\components2\DamMz27.dll,#1
  2⤵
  PID:3140