6fc494a717e1d8ca843578c7c19a27e4403eea0859393fda256d281cfa6f9535

Analysis

max time kernel
1730s
max time network
1168s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:08

Target

jre/bin/instrument.dll
Size

113KB
MD5

ab6ed0cfd0c52dbede1be910efa8a89b
SHA1

83cbc2746a50c155261407ece3d7a5c58aad0437
SHA256

8a6fbb08e0f418a3bb80cc65233e7270c820741dd57525ed7fd3cc479a49396e
SHA512

41773183fc20e42bf208064163aa55658692b9221560146e4f6a676f96fc76541ed82f1efdfa31f8c25ba42f271f7d9087de681da937bbf0eb2c781e027f1218
SSDEEP

1536:0LHPDcdivqC4xMfl/hAxfZ/t0QHQIM7iVxoQCpGlyir0wIOfnToIfemrVZQirM:0rPDco4xMNEfZ1LQG4igmvTBfem7QcM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

416 4908 WerFault.exe rundll32.exe

pid	pid_target	process	target process
416	4908	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4464 wrote to memory of 4908	4464	rundll32.exe	rundll32.exe
PID 4464 wrote to memory of 4908	4464	rundll32.exe	rundll32.exe
PID 4464 wrote to memory of 4908	4464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\instrument.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\instrument.dll,#1
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 608
    3⤵
    - Program crash
    PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4908 -ip 4908
1⤵
PID:3084