b00a57ec224ef5a14a1bace39ce2e3fbca97de17400a1b6fefb92bd3cc715152

Analysis

max time kernel
98s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:50

Target

X86/3_ 0_ 4_ 1/JVSDK.dll
Size

252KB
MD5

a4d3885741613c559153d0f740086992
SHA1

f5d9d628a5c5f703a223a0befd066643c087ca47
SHA256

403dd3d68b320b1fad3c8a4ea39aa0c4466b9d9ef120c9be7c1f876c6b9f0675
SHA512

b1fe376328f64066b4425c400ac1766fd801d08bb5a8be55d657766e820d9a46057b62b12d74789be8f8a88147fdc771f914553bd57f7a43ab9a175d298b1bfc
SSDEEP

3072:8uOLq7S+km0ld9N4PdWyWMK4wpvgxbQsb1qGHR8idkiCJFUlfFQVtbwGpis3K1:ooS+km0jMFUMK4wBgFb1TLd5w6FFOM1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 596	1972	rundll32.exe	28
PID 1972 wrote to memory of 596	1972	rundll32.exe	28
PID 1972 wrote to memory of 596	1972	rundll32.exe	28
PID 1972 wrote to memory of 596	1972	rundll32.exe	28
PID 1972 wrote to memory of 596	1972	rundll32.exe	28
PID 1972 wrote to memory of 596	1972	rundll32.exe	28
PID 1972 wrote to memory of 596	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 4_ 1\JVSDK.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 4_ 1\JVSDK.dll",#1
  2⤵
  PID:596

memory/596-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download