bc3fb6b49d5eb360f09971d9c35275935ad64432a54042a63512175e18e16db0 | Triage

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 18:06

Sharing

Report Analysis Logs

General

Target

jdk/WinFallbackLookup.dll
Size

209KB
MD5

f37dd567987df774e837b44ba5f3fa32
SHA1

63cc406ef45b256222b28f9b5e5263f4eb48878e
SHA256

332a8728b78a7a186c778c5d01b9ff7added45de2a4a49dd021a32b8e9959f50
SHA512

67a60d7e2ef4347b17552229abf22037031ca4fe91db79a80d53266df5a0aa3f4938bb04134d875ab6db09a8d40ad81c030b6f722a26f2b95fe8a677e4f77456
SSDEEP

3072:ANpJfl7WNo9OQSjWP/JX52WPxMafOCjY66gnuEXXK+E:AVR4AOVjSZ87/Cjz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2056	2488	rundll32.exe	28
PID 2488 wrote to memory of 2056	2488	rundll32.exe	28
PID 2488 wrote to memory of 2056	2488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jdk\WinFallbackLookup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2488 -s 80
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads