metasploit | 1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288

Analysis

Target

1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe
Size

311KB
MD5

df211d94b0d76082593b452af98f5af6
SHA1

c37319dc260c4c58901f556e8dc4c0a7a57fda41
SHA256

1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288
SHA512

5f048b52efa626ad2c494afd392559e58a05717d63900f4994588d377a45e74edcdf424cb1df0ece96a0d94efa15d9d9af051210f8be680419522e47da465f2e

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2684	4240	WerFault.exe	1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe
3148	4240	WerFault.exe	1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe

C:\Users\Admin\AppData\Local\Temp\1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe
"C:\Users\Admin\AppData\Local\Temp\1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe"
1⤵
PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 660
  2⤵
  - Program crash
  PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 668
  2⤵
  - Program crash
  PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4240 -ip 4240
1⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4240 -ip 4240
1⤵
PID:4820

memory/4240-130-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4240-131-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download
memory/4240-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4240-133-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download