metasploit | 113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37

Analysis

Target

113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37.dll
Size

242KB
MD5

4aeeb8d5f73f841fcf29d1f0e7565453
SHA1

d093748ddd86667566c9ecfa9717e35af97c3a8b
SHA256

113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37
SHA512

af1aa8d345225153da32b99ca2ea1a4a76f5fd4a6e1b88bc5e739bbc6d63743cb2749d70091cbd0fa81660bc07c0c01c4fe1af8de7518bad677cb51d815690dd

Score

10^/10

Family

metasploit

Version

encoder/fnstenv_mov

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

14 3424 rundll32.exe
16 3424 rundll32.exe
17 3424 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4140 3424 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4140	3424	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3408 wrote to memory of 3424	3408	rundll32.exe	rundll32.exe
PID 3408 wrote to memory of 3424	3408	rundll32.exe	rundll32.exe
PID 3408 wrote to memory of 3424	3408	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\113880f0ac34edce7cdc19fc151d4d974c4c0b39991ff2bc4cd6f62648d48e37.dll,#1
2⤵
- Blocklisted process makes network request
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1848
3⤵
- Program crash
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3424 -ip 3424
1⤵
PID:4248

memory/3424-130-0x0000000000000000-mapping.dmp

Download
memory/3424-131-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3424-133-0x0000000000AF0000-0x0000000000B14000-memory.dmp

Filesize
144KB

Download
memory/3424-132-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3424-134-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3424-136-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3424-137-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3424-138-0x0000000010000000-0x0000000010091000-memory.dmp

Filesize
580KB

Download
memory/3424-139-0x0000000000AF0000-0x0000000000B14000-memory.dmp

Filesize
144KB

Download