7bd8097de078f21e7f97dc04fac6ed6a4d7bc042934e2ec179706838303efe2f

Analysis

Target

cejetjwve.txt.jar
Size

92KB
MD5

9f529d816bffd28587755104a62e7ffe
SHA1

2ced260d71011c450dab5145881fad5460d00edb
SHA256

7bd8097de078f21e7f97dc04fac6ed6a4d7bc042934e2ec179706838303efe2f
SHA512

ccb1437c4fc7465bfdd62e5a7556a13f2bbebafe73e6c545a0125fe0289e833928b6c9f61ce36102ea107a6054f6ac738fae81ac068555fc500f1df15ac6baab

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 1612 WerFault.exe java.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1520 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1520 WerFault.exe

pid	pid_target	process	target process
1520	1612	WerFault.exe	java.exe

pid	process
1520	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

java.exe

description	pid	process	target process
PID 1612 wrote to memory of 1520	1612	java.exe	WerFault.exe
PID 1612 wrote to memory of 1520	1612	java.exe	WerFault.exe
PID 1612 wrote to memory of 1520	1612	java.exe	WerFault.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\cejetjwve.txt.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

memory/1520-55-0x0000000000000000-mapping.dmp

Download
memory/1520-57-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/1612-54-0x000007FEFC4F1000-0x000007FEFC4F3000-memory.dmp

Filesize
8KB

Download