c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/client/jvm.dll
Size 2.5MB
Sample240603-pypr7sgc32
SHA256 b5a3db477b5a66b3b18323d68b231a48576325e8f415131df053366e07d16f86
MD5 a1ac92c4eb1a4ae2906709a5fb94d822
SHA1 83683f12dbfca9b0794afd73a7594a169a5777d4
SHA512 f0285fbba7ececec982f52f7aeb06657c8c6a34e6a14a2fea56b06840d29b5c95a4caafcd0ba059bdd4f8a3737148c790bbf24763dd083b154b56c666e263e03
SSDEEP 49152:ld9ikGk1xpLMkxjnhp1/ADrd0kMa9pQwXpyCbDFUda44Wru/+6TiLlhIIp7G+ncD:ld9ikRL3nhpaZ0uR7GDcv/G
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4056	4616	rundll32.exe	82
PID 4616 wrote to memory of 4056	4616	rundll32.exe	82
PID 4616 wrote to memory of 4056	4616	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\client\jvm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\client\jvm.dll,#1
  2⤵
  PID:4056