8504825018e604414d2ebb1093cf249c2f1d56125f6f33a20b071d6a008b8dd9

Resubmissions

01-04-2022 12:57

01-04-2022 12:56

01-04-2022 12:54

Target

CristalixLauncher-3.0.145.exe
Size

4.3MB
MD5

25b608146d97e46e5cb8d5d4a77440c5
SHA1

ed5d75d64744a971a7bdb79ba68f4eb0aa7d2cab
SHA256

8504825018e604414d2ebb1093cf249c2f1d56125f6f33a20b071d6a008b8dd9
SHA512

3ae601c91d804c4d6c402ba73263e5749fafdfe35d68d510dc3b632a85d897bb1dc0e48dee4710deaea5932bcf34deb9ca13d4c0c664848abca0372190fb38b9

Score

4^/10

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 2120 WerFault.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

4200 java.exe

pid	pid_target	process	target process
1184	2120	WerFault.exe

pid	process
4200	java.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

CristalixLauncher-3.0.145.exejavaw.exe

description	pid	process	target process
PID 1584 wrote to memory of 1836	1584	CristalixLauncher-3.0.145.exe	javaw.exe
PID 1584 wrote to memory of 1836	1584	CristalixLauncher-3.0.145.exe	javaw.exe
PID 1836 wrote to memory of 4200	1836	javaw.exe	java.exe
PID 1836 wrote to memory of 4200	1836	javaw.exe	java.exe

C:\Users\Admin\AppData\Local\Temp\CristalixLauncher-3.0.145.exe
"C:\Users\Admin\AppData\Local\Temp\CristalixLauncher-3.0.145.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\CristalixLauncher-3.0.145.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2120 -ip 2120
1⤵
PID:3256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2120 -s 1964
1⤵
- Program crash
PID:1184

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Filesize
50B

MD5
504e0a9980e70e99a5fecf6f0f518569

SHA1
b571a1a37e32134bdb220b08422bdd67aff3b85d

SHA256
a1e9db0788fbd6d4c5d695c39536ab3dec2a033d52b8fbff3c47fbfcc1badcda

SHA512
91d8fa5e509a23e685b899dee17cf5984e2a7d564973ade4d662f4e88a6055380eb7963abb13805e6ebdd007f575a57a6b74d62c7058f927ee9fdcf785d1eac2

Download Submit
memory/1836-130-0x0000000000000000-mapping.dmp

Download
memory/1836-134-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/1836-141-0x0000000002AF0000-0x0000000011AF0000-memory.dmp

Filesize
240.0MB

Download
memory/1836-150-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/1836-158-0x0000000002AF0000-0x0000000011AF0000-memory.dmp

Filesize
240.0MB

Download
memory/4200-148-0x0000000000000000-mapping.dmp

Download
memory/4200-156-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/4200-162-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/4200-164-0x0000000002340000-0x0000000011340000-memory.dmp

Filesize
240.0MB

Download