75f2450c9475b0adef291c84d08dd8ba99c011d2ee34caef0f34340ef4c6b4e6

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 05:10

Target

FREAKIN/jre/bin/javafx_font_t2k.dll
Size

436KB
MD5

8ae40822b18b10494527ca3842f821d9
SHA1

202dffa7541ad0fad4f0d30cee8c13591dca5271
SHA256

c9742396b80a2241ce5309c388b80000d0786a3cab06a37990b7690fd0703634
SHA512

aa324a265639c67843b4bf6828029b413044cbe4d7f06a253b78b060ea554fecc6e803d59d03742c485b2eb3d52e5c0a44928dcc927501f413ee4664bb8a11f5
SSDEEP

12288:RreTVhY4gXwLR4YS+OX3kQg4O5kM2LY58gwDTxXvwGSelo:Rr4VhyK7eTxXvwelo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	4324	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4324	2552	rundll32.exe	86
PID 2552 wrote to memory of 4324	2552	rundll32.exe	86
PID 2552 wrote to memory of 4324	2552	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FREAKIN\jre\bin\javafx_font_t2k.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FREAKIN\jre\bin\javafx_font_t2k.dll,#1
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 604
    3⤵
    - Program crash
    PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4324 -ip 4324
1⤵
PID:3480