asyncrat | 406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d

Analysis

max time kernel
226s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 13:42

Target

406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe
Size

42KB
MD5

5567263b52d17123678de6b0b82e01be
SHA1

7833228837d04bfdf38c2cec525ad715a0f79e63
SHA256

406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d
SHA512

79c01268cfe0a730b87ba4fb9feb3960b1f3383ffbc55ff4a8fad3b5b239f526446525c14eff482b400fe7579e04c5d0630bf61b848bf506ac3e0f748bdefb51
SSDEEP

768:t1zdCUT0aIvzImZahaMdEf/VoDCOz9eKjbegp1NL5n:D34aazHUef/VbOReGbegbHn

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

780 564 WerFault.exe 406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe

pid	pid_target	process	target process
780	564	WerFault.exe	406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe

description	pid	process	target process
PID 564 wrote to memory of 780	564	406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe	WerFault.exe
PID 564 wrote to memory of 780	564	406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe	WerFault.exe
PID 564 wrote to memory of 780	564	406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe
"C:\Users\Admin\AppData\Local\Temp\406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 564 -s 512
  2⤵
  - Program crash
  PID:780

memory/564-54-0x000000013FA00000-0x000000013FA10000-memory.dmp

Filesize
64KB

Download
memory/780-55-0x0000000000000000-mapping.dmp

Download