metasploit | 113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37

Analysis

Target

113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37.dll
Size

242KB
MD5

4aeeb8d5f73f841fcf29d1f0e7565453
SHA1

d093748ddd86667566c9ecfa9717e35af97c3a8b
SHA256

113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37
SHA512

af1aa8d345225153da32b99ca2ea1a4a76f5fd4a6e1b88bc5e739bbc6d63743cb2749d70091cbd0fa81660bc07c0c01c4fe1af8de7518bad677cb51d815690dd

Score

10^/10

Family

metasploit

Version

encoder/fnstenv_mov

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

4 112 rundll32.exe
6 112 rundll32.exe
8 112 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

568 112 WerFault.exe rundll32.exe

pid	pid_target	process	target process
568	112	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 552 wrote to memory of 112	552	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 568	112	rundll32.exe	WerFault.exe
PID 112 wrote to memory of 568	112	rundll32.exe	WerFault.exe
PID 112 wrote to memory of 568	112	rundll32.exe	WerFault.exe
PID 112 wrote to memory of 568	112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 1376
3⤵
- Program crash
PID:568

memory/112-54-0x0000000000000000-mapping.dmp

Download
memory/112-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/112-56-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/112-57-0x0000000000250000-0x0000000000274000-memory.dmp

Filesize
144KB

Download
memory/112-59-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/112-60-0x0000000000250000-0x0000000000274000-memory.dmp

Filesize
144KB

Download
memory/568-58-0x0000000000000000-mapping.dmp

Download