Analysis
-
max time kernel
56s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/04/2023, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
Minecraft.exe
Resource
win7-20230220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Minecraft.exe
Resource
win10v2004-20230221-en
1 signatures
150 seconds
General
-
Target
Minecraft.exe
-
Size
1.6MB
-
MD5
046a78d20889a0b96b84646b2e59729f
-
SHA1
607ecb749d947d8289fac8073f2764b94acf6b98
-
SHA256
6dfeadbd0411202222726bad50f62547246494d82acb1cb8a2a9448541cf3823
-
SHA512
7a38ab0fe23baa5a5edef05ce299a33e37a924225d8322d0f1cb7a1e5a0deae83199e52ef8371fc7489e87f99064d497658098539575b0d650beed4d979261fe
-
SSDEEP
49152:7NtWy+NF1xMO1UgHrnRAST8XrhaRY0T+nqO4P4s:Jzsbrn3T8hiVT+ne4s
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1504 javaw.exe 1504 javaw.exe 1504 javaw.exe 1504 javaw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1428 wrote to memory of 1504 1428 Minecraft.exe 28 PID 1428 wrote to memory of 1504 1428 Minecraft.exe 28 PID 1428 wrote to memory of 1504 1428 Minecraft.exe 28 PID 1428 wrote to memory of 1504 1428 Minecraft.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -Xms256m -Xmx512m -jar "C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1504
-