f9fe74845c6f81a1584df788bdc56faf2c59eb649f795b4eac330b9b50bb5d79

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:43

Target

jdk/bin/WinFallbackLookup.dll
Size

27KB
MD5

cbbaf83de877d61fd941ea57bffdc744
SHA1

8978e756b9946504a4563e1779e71885e85a96c4
SHA256

98f46d0d4adc9381d696efb3fda9403d896c2f996d49df1e413d6aed93f00aa8
SHA512

4bcc8dcf2dc8cf732b2b3230364e6641fe663897d83d9245d77f8e5060f9ec238cfd918729fd6ff4b2e35eba49ab718d044aa74a4570bbbf5ca9388453f3172c
SSDEEP

384:xdfmwJjzpZHhp6oXn5NeU8OuLXM+3kcU8JIYiaHZ8ZpH3GCJEZyhwh2:xNmwJT6M5Qrv3+YiQZiRBEZJ2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 3004	2452	rundll32.exe	28
PID 2452 wrote to memory of 3004	2452	rundll32.exe	28
PID 2452 wrote to memory of 3004	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jdk\bin\WinFallbackLookup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2452 -s 80
  2⤵
  PID:3004