bc3fb6b49d5eb360f09971d9c35275935ad64432a54042a63512175e18e16db0 | Triage

Analysis

max time kernel
120s
max time network
164s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 18:06

Sharing

Report Analysis Logs

General

Target

jdk/jimage.dll
Size

152KB
MD5

a14407b167980ddc74a7076721d13966
SHA1

8fea6d0d3a339d7b953eba757b5ff7a0a760a253
SHA256

35c88659cdf5a1919a68a1cfd3942d977af8669b65aaeb7a8dec870ede59f273
SHA512

c49b19cfcfd64630e2317f360caf0ce991098735f03a1feaaaef74ae97b9adbe77a6779504f173915b401254dd75a98b3ebef96b06c23443e5747f7020430093
SSDEEP

3072:y94arnWOHj703LyK4HyVyBI1KAJp6aDnOGNg:ALnWOHj707IHra1xO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2764	2552	rundll32.exe	30
PID 2552 wrote to memory of 2764	2552	rundll32.exe	30
PID 2552 wrote to memory of 2764	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jdk\jimage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2552 -s 84
  2⤵
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads