b00a57ec224ef5a14a1bace39ce2e3fbca97de17400a1b6fefb92bd3cc715152 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:50

Sharing

Report Analysis Logs

General

Target

X86/3_ 0_ 6_ 6/JVSDK.dll
Size

253KB
MD5

92d5b856216b5a3f42ef0578e648a5b4
SHA1

9bcf2b29675addc4c9a18039c4e3b30df1a78a19
SHA256

04427b546db65ea8cbdfe5279f37317d2e2dab5a56b2b20467cf598fdfacb09f
SHA512

ec510f19e468415860c16e64d8121c8214cda9138715af033f89563b3f576b708413df9352432b6cb51d656768e0c0ff204351146d6337622f605c98bf0a4a4f
SSDEEP

6144:HWuftBH6/eMFUMK4wBgFb1TLdxIjPJyPgqnbjelw:22tAeFMvwmb1TLcjPJyoUKlw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27
PID 1840 wrote to memory of 1228	1840	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 6_ 6\JVSDK.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 6_ 6\JVSDK.dll",#1
  2⤵
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download