89e7621123c613d82aadfe6defded7f2816a7add36a7ef1576c08206c84fc90d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 16:34

Target

JoltBeacon.dll
Size

170KB
MD5

6a6c11510e1743835c938eb1135d5f8f
SHA1

cab05283c7458cb74499772525f1eeb174ae2daa
SHA256

89e7621123c613d82aadfe6defded7f2816a7add36a7ef1576c08206c84fc90d
SHA512

149c6f5bcf6b05c40e1c040d89586b6d992bbc7c3c23ca24292caa064531f373dee1243249f803fd20abfe53621ec7816d4fdb097cc2ee63bbca209cc993ccd5
SSDEEP

3072:WGDjIrSZFEhB2oMk3pXO+4ao8eB4JP5/xemoyUuziq7:WYj3KhWmODB4//xloyUuuq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2736	2896	rundll32.exe	28

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2736	2896	rundll32.exe	28
PID 2896 wrote to memory of 2736	2896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JoltBeacon.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\msiexec.exe
  \??\C:\Windows\System32\msiexec.exe
  2⤵
  PID:2736

memory/2736-7-0x0000000000030000-0x0000000000070000-memory.dmp

Filesize
256KB

Download
memory/2736-9-0x0000000000030000-0x0000000000070000-memory.dmp

Filesize
256KB

Download
memory/2736-14-0x0000000002420000-0x00000000025C9000-memory.dmp

Filesize
1.7MB

Download
memory/2736-22-0x0000000000030000-0x0000000000070000-memory.dmp

Filesize
256KB

Download
memory/2736-23-0x0000000000030000-0x0000000000070000-memory.dmp

Filesize
256KB

Download
memory/2896-0-0x0000000002510000-0x00000000026B9000-memory.dmp

Filesize
1.7MB

Download