b00a57ec224ef5a14a1bace39ce2e3fbca97de17400a1b6fefb92bd3cc715152

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:50

Target

X86/3_ 0_ 4_ 1/JVSDK.dll
Size

252KB
MD5

a4d3885741613c559153d0f740086992
SHA1

f5d9d628a5c5f703a223a0befd066643c087ca47
SHA256

403dd3d68b320b1fad3c8a4ea39aa0c4466b9d9ef120c9be7c1f876c6b9f0675
SHA512

b1fe376328f64066b4425c400ac1766fd801d08bb5a8be55d657766e820d9a46057b62b12d74789be8f8a88147fdc771f914553bd57f7a43ab9a175d298b1bfc
SSDEEP

3072:8uOLq7S+km0ld9N4PdWyWMK4wpvgxbQsb1qGHR8idkiCJFUlfFQVtbwGpis3K1:ooS+km0jMFUMK4wBgFb1TLd5w6FFOM1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 3516	3712	rundll32.exe	80
PID 3712 wrote to memory of 3516	3712	rundll32.exe	80
PID 3712 wrote to memory of 3516	3712	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 4_ 1\JVSDK.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 4_ 1\JVSDK.dll",#1
  2⤵
  PID:3516

memory/3516-133-0x0000000010000000-0x0000000010298000-memory.dmp

Filesize
2.6MB

Download
memory/3516-134-0x0000000002CC0000-0x0000000002D0C000-memory.dmp

Filesize
304KB

Download