7bd8097de078f21e7f97dc04fac6ed6a4d7bc042934e2ec179706838303efe2f

Analysis

Target
cejetjwve.txt.jar
Size 92KB
Sample210926-twypjsfbd4
SHA256 7bd8097de078f21e7f97dc04fac6ed6a4d7bc042934e2ec179706838303efe2f
MD5 9f529d816bffd28587755104a62e7ffe
SHA1 2ced260d71011c450dab5145881fad5460d00edb
SHA512 ccb1437c4fc7465bfdd62e5a7556a13f2bbebafe73e6c545a0125fe0289e833928b6c9f61ce36102ea107a6054f6ac738fae81ac068555fc500f1df15ac6baab
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	1612	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1520	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1520	1612	java.exe	28
PID 1612 wrote to memory of 1520	1612	java.exe	28
PID 1612 wrote to memory of 1520	1612	java.exe	28

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\cejetjwve.txt.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1612 -s 148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

memory/1520-57-0x0000000001C90000-0x0000000001C91000-memory.dmp

Download

memory/1612-54-0x000007FEFC4F1000-0x000007FEFC4F3000-memory.dmp

Download