9645af60ba2054b47963539d08d5d3d28f447cc0769fd89ba792b5cf2ea10f9f

Resubmissions

10/01/2023, 18:56

10/01/2023, 18:54

10/01/2023, 18:53

max time kernel
23s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 18:54

Target

PCBioUnlock.jar
Size

14.3MB
MD5

2c7d7e84e1026c5611f19bb4a673fbd6
SHA1

e9946b416f1e85a2790c859f9d3946f224e171b8
SHA256

9645af60ba2054b47963539d08d5d3d28f447cc0769fd89ba792b5cf2ea10f9f
SHA512

e7b50ecf83389c3af0f706011d8bb37fa4fd94dbae3adc9e457b0984a25ece4e48e3851d6f7bf06e95b78d1dc71d40668c3f35d1fee62cc7e29a917df9f27213
SSDEEP

393216:KUgjTI1Jp0ipw+v+iupvTdSKHZFV4e9OyN8x:KUDbAo+iu5DV4TyNy

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
1944	java.exe
1944	java.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	java.exe

C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4216219090000.dll

Filesize
9KB

MD5
697d496ac9f5aaab8ae025322358c61e

SHA1
2043eac8cdcc2e24b854af1eacd77a5f2a395a27

SHA256
a7273a4cf48ab3413f2c186cc95a3367a73ce99f8d45329383219d4cc27003aa

SHA512
b6702cd49a3af9f97f697565136f140692af9f8b271e672f2e91c920a23212b778583786f2377078117113647926338614a92c4a2423318b7a21ba2fe3a89838

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2235554844208126751.dll

Filesize
229KB

MD5
cfebe457d00a97c2c5f8930bdbaae1f0

SHA1
526e95d2afde5ef07dd0aca671261dfbc7fcfa17

SHA256
cf8e552ee05cb0e872797ecffe0f9d3dc67e513748f3cd957f79e0f2f3d66ac2

SHA512
fbded4dc03011e58219f622e724c0737475ce95a1a3619ca5e68babe5b734afc664523e93f96047e20d4d82411ccace0bac42f1dc77a2da2f94886ba04fab8a0

Download Submit
memory/1944-136-0x0000000002D90000-0x0000000003D90000-memory.dmp

Filesize
16.0MB

Download
memory/1944-154-0x0000000002D90000-0x0000000003D90000-memory.dmp

Filesize
16.0MB

Download
memory/1944-155-0x0000000002D90000-0x0000000003D90000-memory.dmp

Filesize
16.0MB

Download