55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
589s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_CN.jnlp
Size 4KB
Sample240319-12pgdsha44
SHA256 86663ded105b77261c0556468a93bc8666a094b918299a61af0a8e30f42019c7
MD5 823d1f655440c3912dd1f965a23363fc
SHA1 50b941a38b9c5f565f893e1e0824f7619f51185c
SHA512 1ebf989d2121cf05ffc912b9b228c4d4523763eb1a689ec74568d811c88dcf11032ffc8007bb24daf7d079b580662b77d94b4b8d71a2e891ef27979ff32cd727
SSDEEP 96:Me7R8zl0Zf4z3X4Gv2hEpeStEKADydYL1WfK0eSm91j7:1R8pOfWHJvOJT1WPtK1j7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4288	5104	jp2launcher.exe	93
PID 5104 wrote to memory of 4288	5104	jp2launcher.exe	93

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_zh_CN.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_zh_CN.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3100 --field-trial-handle=2252,i,11231798169170618717,17890004712654885282,262144 --variations-seed-version /prefetch:8
1⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4196 --field-trial-handle=2252,i,11231798169170618717,17890004712654885282,262144 --variations-seed-version /prefetch:8
1⤵
PID:3920