855c267049199087e181fe614656ae4aa2326be0dc43183a97428630bc680a9f

Analysis

max time kernel
643s
max time network
1593s
platform
windows10-1703_x64
resource
win10-20230621-en
resource tags

arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
submitted
22-06-2023 07:25

Target

MCXAuth_5_YT (1).jar
Size

1.1MB
MD5

e889cace707fc62a9334cf5183a12811
SHA1

8dc0c96f4f0a4d25a79a421830ce09a384688ec5
SHA256

9aa46e7487e97ba018896ce08b14f46bbfd0953526dd1695ffd7da6c8f6c2339
SHA512

83546fc736acf67c93b430a880b59bd6c7af156f1e0245623f22ca4ec6304d2e0813de48356be8ec2610b6a2407d9c5de78678ae834f3dd298e961560e562f5f
SSDEEP

24576:K7YKA5vis0LlaPd2B/pNRdXi1qs1n+daBIeEiRMxRCwjZZ:K03hrYwF2B/3Rd2Jh0aBEi+xRJZZ

Score

1^/10

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

java.exe

pid process

2096 java.exe
2096 java.exe
2096 java.exe
2096 java.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2084 wrote to memory of 2096 2084 java.exe java.exe
PID 2084 wrote to memory of 2096 2084 java.exe java.exe

description	pid	process	target process
PID 2084 wrote to memory of 2096	2084	java.exe	java.exe
PID 2084 wrote to memory of 2096	2084	java.exe	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\MCXAuth_5_YT (1).jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe
"C:\Program Files\Java\jdk1.8.0_66\bin\java" -jar "C:\Users\Admin\AppData\Local\Temp\MCXAuth_5_YT (1).jar"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2096

memory/2084-134-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2096-139-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-142-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-164-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-176-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-177-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-182-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-203-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2096-206-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download