3ecc6468de96ac9ae350154c117610dd3062f968be547d6b67b3f126fee512e9

Analysis

Target

NRB-RTGS 28-Sept 2021.jar
Size

103KB
MD5

ccfdd7c24c9029f301ee94dbc9441ace
SHA1

99dce2074fd2cca2ede69a3b08cf33a574a4a976
SHA256

3ecc6468de96ac9ae350154c117610dd3062f968be547d6b67b3f126fee512e9
SHA512

3ca8410aca55b1acb92e1c5316fffb01815b7b69b850c1637cc4b04f43a83f2cf52c21c0785c4af30ce9655782c1d285d82055bb120e41d103f0758bf37fe258

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 1232 WerFault.exe java.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2044 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2044 WerFault.exe

pid	pid_target	process	target process
2044	1232	WerFault.exe	java.exe

pid	process
2044	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2044	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

java.exe

description	pid	process	target process
PID 1232 wrote to memory of 2044	1232	java.exe	WerFault.exe
PID 1232 wrote to memory of 2044	1232	java.exe	WerFault.exe
PID 1232 wrote to memory of 2044	1232	java.exe	WerFault.exe

C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\NRB-RTGS 28-Sept 2021.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

memory/1232-54-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000000000000-mapping.dmp

Download
memory/2044-57-0x0000000001C10000-0x0000000001C11000-memory.dmp

Filesize
4KB

Download