Analysis

  • max time kernel
    96s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 19:10

General

  • Target

    jre/bin/decora_sse.dll

  • Size

    62KB

  • MD5

    b04abe76c4147de1d726962f86473cf2

  • SHA1

    3104bada746678b0a88e5e4a77904d78a71d1ab8

  • SHA256

    07ff22e96dcfd89226e5b85cc07c34318dd32cda23b7ea0474e09338654bfeb3

  • SHA512

    2e4e2feb63b6d7388770d8132a880422abf6a01941bff12cad74db4a641bda2dcc8bf58f6dae90e41cc250b79e7956ddf126943e0f6200272f3376a9a19505f1

  • SSDEEP

    1536:Skh2CQuUlng7qkKi5iO8pm8cN9qOU33oit:Skkhu0nTli5jN8cNAOUHnt

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\decora_sse.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\jre\bin\decora_sse.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3516
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 604
        3⤵
        • Program crash
        PID:3592
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3516 -ip 3516
    1⤵
      PID:3632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads