metasploit | d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50

Analysis

max time kernel
81s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 13:47

Target

d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe
Size

75KB
MD5

b9e812783cdf77e58b8757079bd95e83
SHA1

4ba6248d78c566a22db5f45a4ee5896eac3116a3
SHA256

d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50
SHA512

3b643dece8cfe394dad79ef71c5b9e48682a3d53e2909557bddac4350272b24ea472668b1dea0009ae5430cec77055e137159d312cc75b802d148247868b434b
SSDEEP

1536:xCe8uuXxp4vBt1mcbaxSdnVpvXp0Phe25WZ4Eme/ZRZF+q:WxqvVbaMXAhe2sKCFF/

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4364 set thread context of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	5040	WerFault.exe	82

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82
PID 4364 wrote to memory of 5040	4364	d47b65b49c7bf5486ba15bcee612e70edd0c65b84e7d60d70d0a9527ab1ccc50.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5040 -ip 5040
1⤵
PID:4416

memory/5040-133-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/5040-134-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/5040-135-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download
memory/5040-136-0x0000000029A00000-0x0000000029A1D000-memory.dmp

Filesize
116KB

Download