6a44474937b30831cb33bb838f9f7c363a474db56204e1c0ee823a3dfa2420b0

Analysis

max time kernel
3s
max time network
31s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
06/12/2023, 03:20

Target
jvm.dll
Size 3.8MB
Sample231206-dvs5nsag22
SHA256 8249bcff9a8d9aa7e580076e2c84147571270eb27c74a7dc8df52a447b123d86
MD5 9544b9113212187322433e63957facfb
SHA1 aa6a5404a745a6c683b055b26eccec151234ee68
SHA512 c65ba9dd79ed41f92515280c9f87b94b5495daafc614b708d62fee2307fe51293c829651db070ca2cfe8eb0122dff013be815c0cf58770bc75eddbc5d2360fc6
SSDEEP 98304:bJH91ZGPPYd40G1QVZxrhj20R4JA77gae2CNevFVcv/Gsu:FH91ZxNG1QVZxrhXR4JA77gae2CWcv/q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	2064	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2064	1724	rundll32.exe	72
PID 1724 wrote to memory of 2064	1724	rundll32.exe	72
PID 1724 wrote to memory of 2064	1724	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jvm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jvm.dll,#1
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 664
    3⤵
    - Program crash
    PID:2880