75f2450c9475b0adef291c84d08dd8ba99c011d2ee34caef0f34340ef4c6b4e6 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 05:10

Sharing

Report Analysis Logs

General

Target

FREAKIN/jre/bin/javacpl.dll
Size

156KB
MD5

4e3c37a4de0b5572d69ad79b7a388687
SHA1

6b274e166641f9ce0170e99fe2d1f4319b75a9e8
SHA256

893a86e7b1de81dedab4794732fccd02790756a2dbe4815c102f039088dfcbd2
SHA512

8352a1cd859d17a27560448c6ffb0e8200096cac744c8bb56330397fde0b7f702e2295999d89fbad74df72df200c391113a23a9b4342abac738167967533f9cd
SSDEEP

3072:a2lpElIhbyyH3c1CX766zKELxKvFaPSnjZqMNJlGle:a2rE+xdW+76DEVKv8wv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28
PID 2268 wrote to memory of 2916	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FREAKIN\jre\bin\javacpl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FREAKIN\jre\bin\javacpl.dll,#1
  2⤵
  PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads