3c1029d521ba448c4150d58bd75fd1646f54d72d95d0f91f5dd60656f55eff9a

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2023, 20:39

Target

fabric-installer-0.11.2.exe
Size

399KB
MD5

0604fd84edc6059d39a631eb0ce5a546
SHA1

9ecd7d7df70a25d5ba0ff81e7ad6b59280f71bb6
SHA256

3c1029d521ba448c4150d58bd75fd1646f54d72d95d0f91f5dd60656f55eff9a
SHA512

68e727ea4515ac385e4d757a5e6cff3005ccf50b54e7b5ee1bbb100f18afc09cd814138d31b9e4237a3170bbb3e4a9554e1b4294ec866cd6f63b6e461da8db09
SSDEEP

6144:XbOTF9+lw27APRw3zeFAO8X+KAWCXgy/kJ1o2ww5OxLRfSA4syabpAq:L+z+u9ZF6uKAWCQy/c1HwnBBfL

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3908	javaw.exe
3908	javaw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4624	2188	fabric-installer-0.11.2.exe	84
PID 2188 wrote to memory of 4624	2188	fabric-installer-0.11.2.exe	84
PID 2188 wrote to memory of 3908	2188	fabric-installer-0.11.2.exe	86
PID 2188 wrote to memory of 3908	2188	fabric-installer-0.11.2.exe	86

C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe
"C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\ProgramData\Oracle\Java\javapath\javaw.exe
  "javaw.exe" "-version"
  2⤵
  PID:4624
- C:\ProgramData\Oracle\Java\javapath\javaw.exe
  "javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\fabric-installer-0.11.2.exe" "-fabricInstallerBootstrap" "true"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3908

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
fa1be2b2d830820294656f842d054cdd

SHA1
09aa62269915b6e5a212bedd4c763a6e03f72911

SHA256
911e131f9cbc31b0a53dd151fc3a0d76303b4d021053d1c749f6136f34f5b81c

SHA512
71bb8bfa2433a4f0d4baf715b056ecc36681441353a6f97ec26637e6d952e6a59817e14bac1f9f9562e9d1181c218943527cb20b6c4b3524efea4595febe1b88

Download Submit
memory/3908-156-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-161-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-186-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-196-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-204-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-214-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-224-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-227-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3908-228-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/4624-144-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download