7411c9840d6323a40eee89d2b52dedd12b13486b955d6e84d6221ea312b3ae80

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 08:35

Target

download-stbl-win(V(us))/mod/bin/jfr.dll
Size

22KB
MD5

700f5789d2e7b14b2f5de9fdb755762e
SHA1

f35ede3441d6e5461f507b65b78664a6c425e9ac
SHA256

d115eaf96bd41c7a46400dcff7ef26ac99e3cf7a55a354855c86bae5c69a895a
SHA512

664a442dd424ca04ac0ce072b9bbd5ef7c657b59a26403c44a856738f7998466bfe3010825a13451281841d39b0a34d8997ee24497d626ec60c19aa1af0ee465
SSDEEP

384:YL4Z7lZRiY3PB6cGgOp2m1zq2oatSnPV5zYxkpLfsnYPLr7Ybc:E4PZRiY3PB6cVAebaMnd+ypLkC7Cc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	2488	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2304 wrote to memory of 2488	2304	rundll32.exe	28
PID 2488 wrote to memory of 2336	2488	rundll32.exe	29
PID 2488 wrote to memory of 2336	2488	rundll32.exe	29
PID 2488 wrote to memory of 2336	2488	rundll32.exe	29
PID 2488 wrote to memory of 2336	2488	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jfr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jfr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 224
    3⤵
    - Program crash
    PID:2336