metasploit | 9fd119a1f2fb06c6249b6fa1fdde2143b34ddb9c232d9b427635aceca7b5cdbc

Analysis

max time kernel
41s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:11

Target

9fd119a1f2fb06c6249b6fa1fdde2143b34ddb9c232d9b427635aceca7b5cdbc.dll
Size

50KB
MD5

36d40f828ee493263aae1e3505a5ec28
SHA1

a1a4739d6a3db479c4b7152dbbe4aac93cc1d452
SHA256

9fd119a1f2fb06c6249b6fa1fdde2143b34ddb9c232d9b427635aceca7b5cdbc
SHA512

c01f7ebcf67795f5a487c8f41fc573459e08a24eac95a94be8003996cf8cdb8b33dedfcfc7017dddc1ab6b243118e50325d5e2cc468d8b87961175ddad18949d
SSDEEP

768:KqkYtw7cqPNu/o1C0Z08P5hUbYAuCKzVHWGuZmnThhFzPETpSAj2Nd9a:Kq7w8h0rTAu/xWetw7j2NG

Score

10^/10

Family

metasploit

Version

encoder/fnstenv_mov

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

1064 rundll32.exe

pid	process
1064	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1064	2036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd119a1f2fb06c6249b6fa1fdde2143b34ddb9c232d9b427635aceca7b5cdbc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd119a1f2fb06c6249b6fa1fdde2143b34ddb9c232d9b427635aceca7b5cdbc.dll,#1
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1064

memory/1064-54-0x0000000000000000-mapping.dmp

Download
memory/1064-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1064-57-0x0000000000170000-0x00000000001B0000-memory.dmp

Filesize
256KB

Download
memory/1064-58-0x0000000000170000-0x00000000001B0000-memory.dmp

Filesize
256KB

Download
memory/1064-59-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1064-60-0x0000000000170000-0x00000000001B0000-memory.dmp

Filesize
256KB

Download