e3e190eebf45fad540c7b0c60ded96512988423a535239c1520360862f1eabea

Analysis

Target
VmZTcqSQEiInvb.jar
Size 119KB
Sample210929-lr8d7aede5
SHA256 e3e190eebf45fad540c7b0c60ded96512988423a535239c1520360862f1eabea
MD5 da32f3d108deb072f3d5ab2c6f89ad74
SHA1 7f5371ba442190b1f47815f73a1dbb90009b738d
SHA512 fc9c254150aeed2663fbcf465a3abea965776a81a1c31fec1e9c0ce235844ff88811a276c75a067d9c13c4de312eb55a431e4d1a0acfee93efb4342a672eaced
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	1652	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1888	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1888	1652	java.exe	26
PID 1652 wrote to memory of 1888	1652	java.exe	26
PID 1652 wrote to memory of 1888	1652	java.exe	26

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\VmZTcqSQEiInvb.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1652 -s 148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1888

memory/1652-60-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmp

Download

memory/1888-63-0x0000000000460000-0x0000000000461000-memory.dmp

Download