7c4f34556d1064cbe1889b7d6567b6f8baccaa9d33c18b18f7a2dfb0458484d1

Analysis

max time kernel
61s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 23:12

Target

WARZONE RAT 3.03/Datas/firefox.dll
Size

2.3MB
MD5

a26861558315278d5960fe1bf58b1950
SHA1

4b71194940c91fdd44909b8cf262000b10a3f7a8
SHA256

b52720863ec78e0f7bff98e6c809fdf50ab2d0ea361e95eb5341e870aafb0354
SHA512

63a7376abe6907d9d25202c8611b2dc15386b287e23aa8755fe0b7ffc5b5cb40ef03716bab3968440f0eca2689fa195809bad48cd1ef3718bcdb9081538cfb83
SSDEEP

49152:f7Pi205SP4PJ+LzW5ygDwnEZIYkjgWjblMSRpMqxsFYrt:f7P705mAF5zD6sILTjblMS3Ft

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 180 wrote to memory of 4688	180	rundll32.exe	rundll32.exe
PID 180 wrote to memory of 4688	180	rundll32.exe	rundll32.exe
PID 180 wrote to memory of 4688	180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\Datas\firefox.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\Datas\firefox.dll",#1
2⤵
PID:4688