c494914f88a57d26ed4d568d267f51dff01868c4096aded6d71634d2df97a375 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:48

Sharing

Report Analysis Logs

General

Target

Vape V4/jvm.dll
Size

8.4MB
MD5

6f5e0338090bb4e3d2ab8ce05367108f
SHA1

3afb0bc88d7e75cfe0771f5766b96d14faa58cf5
SHA256

f8a7d249e40749bb9795b6dc39069c7a7ec2cddff998b9cb1e0341d794d8cf33
SHA512

991ff902ab40b542d26e861fe864d7090730ba78f2a35fff2316e8250df09eb8d96125861c60af52b9e6dd927fd26718f1c1d3af38834253cac30da2dcde3c17
SSDEEP

196608:DhN3ImMnysGhKwPLeNTKZ2gyp8C+WVUTWnS:DhN3ImMnysGwwPLeN3gxC+WVUanS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2504 wrote to memory of 1928	2504	rundll32.exe	30
PID 2504 wrote to memory of 1928	2504	rundll32.exe	30
PID 2504 wrote to memory of 1928	2504	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vape V4\jvm.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2504 -s 96
  2⤵
  PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads