75f2450c9475b0adef291c84d08dd8ba99c011d2ee34caef0f34340ef4c6b4e6

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 05:10

Target

FREAKIN/jre/bin/javacpl.dll
Size

156KB
MD5

4e3c37a4de0b5572d69ad79b7a388687
SHA1

6b274e166641f9ce0170e99fe2d1f4319b75a9e8
SHA256

893a86e7b1de81dedab4794732fccd02790756a2dbe4815c102f039088dfcbd2
SHA512

8352a1cd859d17a27560448c6ffb0e8200096cac744c8bb56330397fde0b7f702e2295999d89fbad74df72df200c391113a23a9b4342abac738167967533f9cd
SSDEEP

3072:a2lpElIhbyyH3c1CX766zKELxKvFaPSnjZqMNJlGle:a2rE+xdW+76DEVKv8wv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2568	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1396	4084	rundll32.exe	99
PID 4084 wrote to memory of 1396	4084	rundll32.exe	99
PID 4084 wrote to memory of 1396	4084	rundll32.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FREAKIN\jre\bin\javacpl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FREAKIN\jre\bin\javacpl.dll,#1
  2⤵
  PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=2232,i,9772508353233483703,11473701862007458502,262144 --variations-seed-version /prefetch:8
1⤵
PID:2620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

memory/2568-0-0x000001D4AAD40000-0x000001D4AAD50000-memory.dmp

Filesize
64KB

Download
memory/2568-16-0x000001D4AAE40000-0x000001D4AAE50000-memory.dmp

Filesize
64KB

Download
memory/2568-32-0x000001D4B3140000-0x000001D4B3141000-memory.dmp

Filesize
4KB

Download
memory/2568-34-0x000001D4B3170000-0x000001D4B3171000-memory.dmp

Filesize
4KB

Download
memory/2568-35-0x000001D4B3170000-0x000001D4B3171000-memory.dmp

Filesize
4KB

Download
memory/2568-36-0x000001D4B3280000-0x000001D4B3281000-memory.dmp

Filesize
4KB

Download