b00a57ec224ef5a14a1bace39ce2e3fbca97de17400a1b6fefb92bd3cc715152 | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:50

Sharing

Report Analysis Logs

General

Target

X86/3_ 0_ 7_ 0/JVSDK.dll
Size

100KB
MD5

7ecaf9f1f222e0c3bdae0deeb9e0e39f
SHA1

3f13fa5347e51adfd331549ea6d5fcc498720031
SHA256

d8e843217eff6bc712bf8f138c862d3476758267c83564f7ac5541027f4df7df
SHA512

4e44fef16d3b6c149533a75015588686b13d2a46e6cec71ef59e45eb146d5cb14d30bc0952aa963f10c540a7303155372ff84a37618f964849eb656fbaa7ecbf
SSDEEP

3072:o5FjA+/lho/rAovJ5hevvvvvvvvvvvvvv/Qhznyu:eFjA+/lorvvJf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27
PID 1448 wrote to memory of 1480	1448	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 7_ 0\JVSDK.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 7_ 0\JVSDK.dll",#1
  2⤵
  PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x0000000000000000-mapping.dmp

Download
memory/1480-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download