d7dfd3d310c5139ded39804866563572b64969bf71ae556b59edcae9680efe30

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 21:51

Target

Discord Toolz/Utils/API's/bin/Binaries/RtkBtManServ.exe
Size

4.4MB
MD5

3405f654559010ca2ae38d786389f0f1
SHA1

8ac5552c64dfc3ccf0c678f6f946ee23719cf43d
SHA256

bc1364d8e68f515f9f35a6b41c11a649b1f514302eb01812c68c9a95a3198b30
SHA512

cb1e5ffed2ab86502ea4236383e9a4211a14b1abda13babbcceea67700c5746b37b4da6e45e10196eb76fa1e6959e71f19c6827466a54df1d5ba5ad2e16fc05b
SSDEEP

98304:lQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:ozUcwti7TQlF3ZxxWJSUnDv

Score

9^/10

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral17/memory/1064-54-0x0000000000290000-0x000000000070A000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral17/memory/1064-54-0x0000000000290000-0x000000000070A000-memory.dmp	Nirsoft

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

932 1064 WerFault.exe RtkBtManServ.exe

pid	pid_target	process	target process
932	1064	WerFault.exe	RtkBtManServ.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

RtkBtManServ.exe

description	pid	process	target process
PID 1064 wrote to memory of 932	1064	RtkBtManServ.exe	WerFault.exe
PID 1064 wrote to memory of 932	1064	RtkBtManServ.exe	WerFault.exe
PID 1064 wrote to memory of 932	1064	RtkBtManServ.exe	WerFault.exe
PID 1064 wrote to memory of 932	1064	RtkBtManServ.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Utils\API's\bin\Binaries\RtkBtManServ.exe
"C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Utils\API's\bin\Binaries\RtkBtManServ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 556
2⤵
- Program crash
PID:932

memory/932-56-0x0000000000000000-mapping.dmp

Download
memory/1064-54-0x0000000000290000-0x000000000070A000-memory.dmp

Filesize
4.5MB

Download
memory/1064-55-0x0000000004F10000-0x0000000004FC0000-memory.dmp

Filesize
704KB

Download