bc3fb6b49d5eb360f09971d9c35275935ad64432a54042a63512175e18e16db0

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 18:06

Target

jdk/jdwp.dll
Size

362KB
MD5

1429902b4415513030a1bb576f2e1eb5
SHA1

7dd09659c9c22516f3111c0cde473ed2a07c1e3d
SHA256

c5cdee7f763f190f75f8a37e2bcebe79b948bf95963d14a635026fce0ceeea03
SHA512

20c0fdc7c15ea2489e1991a2c3e4a6511c75d732d3ea0a3acf9d38e1f1778680c736da7ddb9ea57fbc7333fd0826950395f2939fd0ada672b12e9934f4417a8f
SSDEEP

6144:oNKXPXoDbZ5HQoqAgHoqmHfoROWtpnWdkmap+EMx8WwDp+ARI+eonTfeHrBBvTyM:owfoDbZ5HQoqAgHoqmHgROWtpnWdkmaS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2652	2196	rundll32.exe	28
PID 2196 wrote to memory of 2652	2196	rundll32.exe	28
PID 2196 wrote to memory of 2652	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jdk\jdwp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2196 -s 80
  2⤵
  PID:2652