35ae80f3781c2af00531dbdabe71af3003662fc11faad99fd31c30ac3b34627c

Analysis

max time kernel
134s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/06/2024, 08:14

Target

Blindness/autorun/dlls/32/CEJVMTI.dll
Size

49KB
MD5

b02fa5c8eefbcd010aaac97a94ff62bb
SHA1

fd88f2fc529515252cbcab507f322b080853c38b
SHA256

7bd0d77fd790215bb67337f9f210b05aaab0193d105b8ff86ec422e9875eb033
SHA512

1d18cb2cffbf83ef949c2a34fa28c4e011c623c62ce743c7f320db1acfbd41bea2ea6d3f0d93a34874973fc43367d6562c630f8b7912b22be7ccc61851001a18
SSDEEP

768:+B4cf1fqCWPiiyDf+TTmhX2cnX3/OtC2MD0OK9BRbAlQ4z:El38CfKmhXv/Ott20OKvR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4496	1412	rundll32.exe	73
PID 1412 wrote to memory of 4496	1412	rundll32.exe	73
PID 1412 wrote to memory of 4496	1412	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Blindness\autorun\dlls\32\CEJVMTI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Blindness\autorun\dlls\32\CEJVMTI.dll,#1
  2⤵
  PID:4496