40ba07f9761a6565642d7aae57f2f4622030e33fe80eb46a543446dcb8e3f1ca

Analysis

Target

437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Size

3.5MB
MD5

7ec07e27817c7dc87b3cf22533509581
SHA1

b3cd8a2386897d53133b8a6193989f2a6324a71f
SHA256

437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f
SHA512

aed38074b14d441566677af3cada2b695f2ffca9651e79f3df0ccad9daac8c69d03cca016a4bd36a9fc3e798debe4a39cb60d00ef566c02c25813c35d6ccf36f

Score

4^/10

Drops file in Program Files directory 12 IoCs

Processes:

javaw.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	javaw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

javaw.exe

pid process

3020 javaw.exe
3020 javaw.exe

pid	process
3020	javaw.exe
3020	javaw.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe

description	pid	process	target process
PID 652 wrote to memory of 3020	652	437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe	javaw.exe
PID 652 wrote to memory of 3020	652	437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
"C:\Users\Admin\AppData\Local\Temp\437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652

memory/3020-2-0x0000000000000000-mapping.dmp

Download
memory/3020-3-0x0000000002990000-0x0000000002C00000-memory.dmp

Filesize
2.4MB

Download
memory/3020-4-0x0000000002C00000-0x0000000002C10000-memory.dmp

Filesize
64KB

Download
memory/3020-5-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/3020-6-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Filesize
64KB

Download
memory/3020-7-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/3020-8-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/3020-10-0x0000000002C40000-0x0000000002C50000-memory.dmp

Filesize
64KB

Download
memory/3020-9-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/3020-11-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/3020-12-0x0000000002C60000-0x0000000002C70000-memory.dmp

Filesize
64KB

Download
memory/3020-13-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/3020-14-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

Filesize
64KB

Download
memory/3020-15-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/3020-16-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

Filesize
64KB

Download