a11f58835e0bc2bca60c3532dc0bd3468f1cbe2d688cbb6027ffa6931cedb41f | Triage

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 13:57

Sharing

Report Analysis Logs

General

Target

JTIScannerBOProxy.dll
Size

132KB
MD5

f3b284732d02ee305d4bf1d0d27cc890
SHA1

1e1f79e508980ccc1729562b4423f2aa49915b4f
SHA256

3d42386fd909a1fd9f2c0f91d619064d351e68c4001ffa815ec3815738cf7bf1
SHA512

1c09c452cf46e4b2f2093c6d09590e85ffc20315a1fc18c11eacf18ef26ead8a7f3a30fe636c9a7683779ac1b413e3867903c58fab38410dae86f8d0d8e2e560
SSDEEP

3072:mSt3UJUUIbiFABqSoCWqwEjEoNc6faI5:rdUJUUlADNAx4hfN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 3408	2792	rundll32.exe	86
PID 2792 wrote to memory of 3408	2792	rundll32.exe	86
PID 2792 wrote to memory of 3408	2792	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JTIScannerBOProxy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JTIScannerBOProxy.dll,#1
  2⤵
  PID:3408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads