b00a57ec224ef5a14a1bace39ce2e3fbca97de17400a1b6fefb92bd3cc715152 | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:50

Sharing

Report Analysis Logs

General

Target

X86/3_ 0_ 8_ 2/JVSDK.dll
Size

64KB
MD5

bfa38757c7ef29160fbac4093e673bd0
SHA1

2adda04dda9d47c96507ff10ecb1a778f446824b
SHA256

fd0ce9d53282fc60c112ed3766211fae9a6657b996976b28638dcbc92e0a9fd2
SHA512

27e84092ed6c229e95331315ce7667faa041f2d8f5ccdb3352f3fa2b275aa3a4331e6d021ecea01d5fbf3c91527b42b07ae967f8c97aee80d5bd682b5cccf2a0
SSDEEP

768:JFr1CEQw6wT6Y9kz9CrlvHLC7vNDqIsHuyD3mb7:JLCEQw6wT6Y9kz9cxeDNDqIsvD3S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26
PID 1464 wrote to memory of 1516	1464	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 8_ 2\JVSDK.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 8_ 2\JVSDK.dll",#1
  2⤵
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000000000000-mapping.dmp

Download
memory/1516-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download