7a49a4b9abce43fa14a5f8b0b5af90d3751e994fda07ab7aa4c6fc2917f6da1d

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/10/2024, 19:49

Target
Vape V4/jvm.dll
Size 8.4MB
Sample241028-yjtx2stmax
SHA256 f8a7d249e40749bb9795b6dc39069c7a7ec2cddff998b9cb1e0341d794d8cf33
MD5 6f5e0338090bb4e3d2ab8ce05367108f
SHA1 3afb0bc88d7e75cfe0771f5766b96d14faa58cf5
SHA512 991ff902ab40b542d26e861fe864d7090730ba78f2a35fff2316e8250df09eb8d96125861c60af52b9e6dd927fd26718f1c1d3af38834253cac30da2dcde3c17
SSDEEP 196608:DhN3ImMnysGhKwPLeNTKZ2gyp8C+WVUTWnS:DhN3ImMnysGwwPLeN3gxC+WVUanS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2112	2828	rundll32.exe	28
PID 2828 wrote to memory of 2112	2828	rundll32.exe	28
PID 2828 wrote to memory of 2112	2828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vape V4\jvm.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 96
  2⤵
  PID:2112