7411c9840d6323a40eee89d2b52dedd12b13486b955d6e84d6221ea312b3ae80

Analysis

max time kernel
119s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 08:35

Target

download-stbl-win(V(us))/mod/bin/jfxwebkit.dll
Size

32.4MB
MD5

4d857a5fc9ca16d2a67872faccf85d9f
SHA1

eaeb632e526efa946e4db1b8cfa31de6a7b03219
SHA256

7ffa7423dda07499394b345e5ece2d54c8e19247e6e76c0e23b5bf1470ab0d7f
SHA512

8dbc8675ce2dace8d629c3fa66cf65704346ab829ae0b0a1d7b25be22783b7e73624ba70f6d67264d6ca1656d7590e3753a8df2227da45112c5bd4a5654089af
SSDEEP

393216:VJ8d7SMzwH5R2sdDcBwHHdI4DKRlDsqXCagQZhzvilh2Wlq7ODI:VJ8d7zzUesdDtevn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4836	2232	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2232	2840	rundll32.exe	84
PID 2840 wrote to memory of 2232	2840	rundll32.exe	84
PID 2840 wrote to memory of 2232	2840	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jfxwebkit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\download-stbl-win(V(us))\mod\bin\jfxwebkit.dll,#1
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 628
    3⤵
    - Program crash
    PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2232 -ip 2232
1⤵
PID:3248