6fc494a717e1d8ca843578c7c19a27e4403eea0859393fda256d281cfa6f9535 | Triage

Analysis

max time kernel
1799s
max time network
1178s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:08

Sharing

Report Analysis Logs

General

Target

jre/bin/java.dll
Size

123KB
MD5

73bd0b62b158c5a8d0ce92064600620d
SHA1

63c74250c17f75fe6356b649c484ad5936c3e871
SHA256

e7b870deb08bc864fa7fd4dec67cef15896fe802fafb3009e1b7724625d7da30
SHA512

eba1cf977365446b35740471882c5209773a313de653404a8d603245417d32a4e9f23e3b6cd85721143d2f9a0e46ed330c3d8ba8c24aee390d137f9b5cd68d8f
SSDEEP

3072:Kw2b3Kr+uWU9XzFhziJ1TBZAhsIn/B9NZwMgjeNXLD:43KFFheLCBpV/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3780 wrote to memory of 2332	3780	rundll32.exe	rundll32.exe
PID 3780 wrote to memory of 2332	3780	rundll32.exe	rundll32.exe
PID 3780 wrote to memory of 2332	3780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\java.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\java.dll,#1
  2⤵
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads