0994bacabba34499288c55d9568f4e73a2c5bef849fde42fc03052bf63948e57 | Triage

Analysis

max time kernel
111s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2022 01:45

Sharing

Report Analysis Logs

General

Target

xise/jsc.dll
Size

36KB
MD5

5cab78922b94fa154a0bd75ac4e6ca44
SHA1

0d98aa34abef8092dbd3547b8626cf191597a3b8
SHA256

a69c50195ebbd41e5fe11f98d59ebc81df736ddf0b0c8571bd9bb7d2642bd68f
SHA512

340174f974090de6698ee26661584629c1ef5e629eae789c6facf8aa5ddf162fead57d6a654660a936c02e9158416e842f55a898c8f4b0dda808b0a8ca4d50b9
SSDEEP

384:5UIBq7yFryaMI8nKWWpTU2gQdDuqMapK7a/CQgYJN6RlsnED3WyLOMDlQqDQs:mmaF5KJlVgwuqLmblsneJL75Es

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4288	4568	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4568	4408	rundll32.exe	79
PID 4408 wrote to memory of 4568	4408	rundll32.exe	79
PID 4408 wrote to memory of 4568	4408	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xise\jsc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xise\jsc.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 616
    3⤵
    - Program crash
    PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4568 -ip 4568
1⤵
PID:4704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads