ab27a0834431e78d7424993f5e5395777acae5408a0d5eb9c2f841d27b154484 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/03/2023, 17:20

Sharing

Report Analysis Logs

General

Target

java_crw_demo.dll
Size

31KB
MD5

9dad7beb06496a3d1f8c7577459098f2
SHA1

c6c7a323e64c78c7b5ebd0520d958baf28b86492
SHA256

ab27a0834431e78d7424993f5e5395777acae5408a0d5eb9c2f841d27b154484
SHA512

4c01b19452100ed230b99c899f0c2be1780fd8d7e87a219c7be8f71de98f54ef5774a1e7211a6b4719e6c14f687ca213bc8ea313ee823e0b79c3ddde6ea2a639
SSDEEP

384:9B/apIy0kJo26spOeQ5ZzgdOyhINLJgKgwYyDG8pQZeL4i/8E9VFwL:P/TQJ3pOBzZLgKgFyDGFEeEs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	932	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1704	932	rundll32.exe	27
PID 932 wrote to memory of 1704	932	rundll32.exe	27
PID 932 wrote to memory of 1704	932	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\java_crw_demo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 932 -s 84
  2⤵
  - Program crash
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads