d1843a3d0326fd5e516bab8171e756ef417e6f740faf3003db8178516bc60b89

Resubmissions

30/03/2023, 23:34

30/03/2023, 23:31

max time kernel
35s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/03/2023, 23:34

Target

launcher-1.09_16.exe
Size

711KB
MD5

7604d8a9b4c4b9ca9e25216f9b4ab99f
SHA1

309e1722bfb7812e4d19d4e06db97a6ecd8cb30c
SHA256

d1843a3d0326fd5e516bab8171e756ef417e6f740faf3003db8178516bc60b89
SHA512

7e9d7fdab97ffe0f7fde949ea5d8355d0efc89b8769102e55425958491978a438c82cf944255be6f70103c7a2b0d4c115bb9b9e5f0dec95c0b4c84dcf4fbdc93
SSDEEP

12288:Eh1gvaO9uz48+RTw4uI8w90bYKaLRmRcW83YQFXrLia73lnxHAedbcZzC:Eh1gvaQuk8cU4unwQaXW0YQ9rn3lnVd1

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2996	2616	launcher-1.09_16.exe	83
PID 2616 wrote to memory of 2996	2616	launcher-1.09_16.exe	83

C:\Users\Admin\AppData\Local\Temp\launcher-1.09_16.exe
"C:\Users\Admin\AppData\Local\Temp\launcher-1.09_16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\launcher-1.09_16.exe"
  2⤵
  PID:2996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3032

memory/2616-133-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download