656eb4d10487e855a11b88e487b887e88f8d3540f14c6a08869e83f8c2d5e13f

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 00:54

Target

Mozilla Firefox/msvcp140.dll
Size

559KB
MD5

c3d497b0afef4bd7e09c7559e1c75b05
SHA1

295998a6455cc230da9517408f59569ea4ed7b02
SHA256

1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
SHA512

d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
SSDEEP

12288:mPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDaM:sqwpzSFJQEKZm+jWodEEq9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1720	2284	rundll32.exe	28
PID 2284 wrote to memory of 1720	2284	rundll32.exe	28
PID 2284 wrote to memory of 1720	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mozilla Firefox\msvcp140.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 80
  2⤵
  PID:1720