metasploit | d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 13:47

Target

d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe
Size

75KB
MD5

b9e812783cdf77e58b8757079bd95e83
SHA1

4ba6248d78c566a22db5f45a4ee5896eac3116a3
SHA256

d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50
SHA512

3b643dece8cfe394dad79ef71c5b9e48682a3d53e2909557bddac4350272b24ea472668b1dea0009ae5430cec77055e137159d312cc75b802d148247868b434b
SSDEEP

1536:xCe8uuXxp4vBt1mcbaxSdnVpvXp0Phe25WZ4Eme/ZRZF+q:WxqvVbaMXAhe2sKCFF/

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27
PID 1652 wrote to memory of 1288	1652	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	27

C:\Users\Admin\AppData\Local\Temp\d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe
"C:\Users\Admin\AppData\Local\Temp\d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe
  "C:\Users\Admin\AppData\Local\Temp\d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe"
  2⤵
  PID:1288

memory/1288-54-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/1288-55-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/1288-57-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/1288-59-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/1288-62-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/1288-65-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download