ae33e9f2e18d4fdd25db5bc30b8b8bdd63b53794e225dbe818ebe65a29b0dc95

Analysis

Target
Orderlistxlsx.jar
Size 129KB
Sample210830-fl8dly9cye
SHA256 ae33e9f2e18d4fdd25db5bc30b8b8bdd63b53794e225dbe818ebe65a29b0dc95
MD5 d82b9d7af67f2ade0c11bfe6bfd69544
SHA1 051c9770aebcc850ae09baa6a223848a7aa3f289
SHA512 fbfc1943e95be1d5c9a536e2aa9267b188eb81e9c9445074c2b69d01f7d092c0d1590e15c8579da0c6ab1ba97e1767cd5a2984a1eb6e08611df3fec5764dc555
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1656	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1780	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1780	1656	java.exe	28
PID 1656 wrote to memory of 1780	1656	java.exe	28
PID 1656 wrote to memory of 1780	1656	java.exe	28

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Orderlistxlsx.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1656 -s 148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1780

memory/1656-60-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Download

memory/1780-63-0x0000000002140000-0x0000000002141000-memory.dmp

Download