920d80efcbeee1a05139ffbea05ca56e59e71809d11afbe47d1e2e9aa95a0e5b

Analysis

Target
Quotation.jar
Size 106KB
Sample210826-pyvmn8ldas
SHA256 920d80efcbeee1a05139ffbea05ca56e59e71809d11afbe47d1e2e9aa95a0e5b
MD5 79d2b79bad5f52b3bd2e82327f871c92
SHA1 b0f67fa71525e2f843e73e84661ee638b0463f30
SHA512 5b335834449a94a6565bc5f26e50d248b3cf59ad7e31465e5522ebaf80d39ed9816e1f86c47e85a608ae16968b6f3636c1b521a822afef24f53826b17c3fcd75
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	1748	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2012	1748	java.exe	27
PID 1748 wrote to memory of 2012	1748	java.exe	27
PID 1748 wrote to memory of 2012	1748	java.exe	27

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quotation.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1748 -s 148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2012

memory/1748-60-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmp

Download

memory/2012-63-0x0000000001C10000-0x0000000001C11000-memory.dmp

Download