54ba841477c4699c23f3770e5eee79633efa40401e2680cfefec60c19e2c98a6

Analysis

max time kernel
143s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 20:04

Target

jre/bin/glass.dll
Size

196KB
MD5

434cbb561d7f326bbeffa2271ecc1446
SHA1

3d9639f6da2bc8ac5a536c150474b659d0177207
SHA256

1edd9022c10c27bbba2ad843310458edaead37a9767c6fc8fddaaf1adfcbc143
SHA512

9e37b985ecf0b2fef262f183c1cd26d437c8c7be97aa4ec4cd8c75c044336cc69a56a4614ea6d33dc252fe0da8e1bbadc193ff61b87be5dce6610525f321b6dc
SSDEEP

3072:lC0MaRHVsSduCCkNlKpR1FHNnuNcCwJPT54l2B3Fzkmldrz5ZD9hYJOj9T3iRK:s0XR1sYtxgGl2B3uWjhYJOj9TSY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 544	2652	rundll32.exe	80
PID 2652 wrote to memory of 544	2652	rundll32.exe	80
PID 2652 wrote to memory of 544	2652	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\glass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\glass.dll,#1
  2⤵
  PID:544