20351665df8b2d441524a21163e0aa95ea3d3805a873032eb6f55fa1001f3941

Analysis

Target

Quotation.jar
Size

184KB
MD5

8eab8f1a928fa55303b7558536079a2a
SHA1

491e913225a8c8d144c538fe27cf62f5a8465b38
SHA256

20351665df8b2d441524a21163e0aa95ea3d3805a873032eb6f55fa1001f3941
SHA512

886928d68f14c012186872429739d1317350f329e5afa4ec820779e7f312d776433e8926000f522a3393e2ad454779eee1245ba266226bd0c8421f1fb97ba4a0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 2012 WerFault.exe java.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1120 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1120 WerFault.exe

pid	pid_target	process	target process
1120	2012	WerFault.exe	java.exe

pid	process
1120	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1120	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

java.exe

description	pid	process	target process
PID 2012 wrote to memory of 1120	2012	java.exe	WerFault.exe
PID 2012 wrote to memory of 1120	2012	java.exe	WerFault.exe
PID 2012 wrote to memory of 1120	2012	java.exe	WerFault.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quotation.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

memory/1120-55-0x0000000000000000-mapping.dmp

Download
memory/1120-57-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2012-54-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download