Overview
overview
3Static
static
1JTIScannerBO.dll
windows7-x64
3JTIScannerBO.dll
windows10-2004-x64
3JTIScannerBOProxy.dll
windows7-x64
1JTIScannerBOProxy.dll
windows10-2004-x64
1JTIScannerIf.dll
windows7-x64
1JTIScannerIf.dll
windows10-2004-x64
1JTIShim.dll
windows7-x64
1JTIShim.dll
windows10-2004-x64
1JcmProfiler.dll
windows7-x64
1JcmProfiler.dll
windows10-2004-x64
1JcmRts.dll
windows7-x64
1JcmRts.dll
windows10-2004-x64
1ReputationBOProxy.dll
windows7-x64
1ReputationBOProxy.dll
windows10-2004-x64
1Analysis
-
max time kernel
132s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
JTIScannerBO.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
JTIScannerBO.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
JTIScannerBOProxy.dll
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
JTIScannerBOProxy.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
JTIScannerIf.dll
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
JTIScannerIf.dll
Resource
win10v2004-20231025-en
Behavioral task
behavioral7
Sample
JTIShim.dll
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
JTIShim.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
JcmProfiler.dll
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
JcmProfiler.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
JcmRts.dll
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
JcmRts.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
ReputationBOProxy.dll
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
ReputationBOProxy.dll
Resource
win10v2004-20231023-en
General
-
Target
JTIScannerIf.dll
-
Size
136KB
-
MD5
237c58ab0461e6c7be549e13ac3200b9
-
SHA1
4a25864c22a64440f0d17759749959a26a1eedaf
-
SHA256
82c5c68b6761c58e03043b081b2d64703fcb906e24fe12aef9674581529510d3
-
SHA512
af498c9c1592b4939aae65cf5301d9ebb54f32a8f9de494facb6608ffefba1af79ff505c1ef73c7f57568e6ecef5bd0d42ec9a4fd7acc02c91ddc74eebc111d8
-
SSDEEP
3072:GbDfy2l+egZ+63hsearopU08pMhK1gOgKG7cKGcAxht:Wy2seEKJCK01GcAx
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2372 wrote to memory of 860 2372 rundll32.exe 55 PID 2372 wrote to memory of 860 2372 rundll32.exe 55 PID 2372 wrote to memory of 860 2372 rundll32.exe 55