b00a57ec224ef5a14a1bace39ce2e3fbca97de17400a1b6fefb92bd3cc715152 | Triage

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:50

Sharing

Report Analysis Logs

General

Target

X86/3_ 0_ 5_ 4/JVSDK.dll
Size

253KB
MD5

fc60e3076aacdb02671301211cf84fc4
SHA1

01871167882a9cc3a8977a1f4bc3d33a13da7806
SHA256

aa7c6027daa2b0ca0fbb6441cf1fd16db0f043f71c853f2537060e51d3981c26
SHA512

b2121c6c45dac1447a937420323ad31a6ca66fb625f7eaffdcc094208a24c41e83d0794f939e0d2b4988dc43fa0e79de59a6ec83eed1ea45df9a97848a458596
SSDEEP

6144:rpDh9FMFUMK4wBgFb1TLdOd48R4yO3/6CX2:rZhvFMvwmb1TLijRK3/X2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 804	608	rundll32.exe	28
PID 608 wrote to memory of 804	608	rundll32.exe	28
PID 608 wrote to memory of 804	608	rundll32.exe	28
PID 608 wrote to memory of 804	608	rundll32.exe	28
PID 608 wrote to memory of 804	608	rundll32.exe	28
PID 608 wrote to memory of 804	608	rundll32.exe	28
PID 608 wrote to memory of 804	608	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 5_ 4\JVSDK.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X86\3_ 0_ 5_ 4\JVSDK.dll",#1
  2⤵
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download