asyncrat | dbadd138fcadb07f4be4f21666e2a17ac9821a13be6f6bf139808255919ed3cb

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-03-2023 03:23

Target

5fbd8561540a6246de5e402214da86d0.exe
Size

38KB
MD5

5fbd8561540a6246de5e402214da86d0
SHA1

65b29f52856448ec781efce09bb7f9ae3ffcf63d
SHA256

dbadd138fcadb07f4be4f21666e2a17ac9821a13be6f6bf139808255919ed3cb
SHA512

765e979688ddf1bc9bc6067467e49139d45248bef9b8221ac95cdffadcb981446888ad9a77fc56e1c4d7a4587c7202901c3c2432821dc5c8507d378364ff48fb
SSDEEP

768:kXaug0LrCc4duVtOjkR26/XgNhKwOuyj6TTyKDGdtrXDjkY5Z07:YafSXVtOGfgTKwr2bNE7

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1260-54-0x00000000011F0000-0x0000000001200000-memory.dmp	asyncrat

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1324 1260 WerFault.exe 5fbd8561540a6246de5e402214da86d0.exe

pid	pid_target	process	target process
1324	1260	WerFault.exe	5fbd8561540a6246de5e402214da86d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5fbd8561540a6246de5e402214da86d0.exe

description	pid	process	target process
PID 1260 wrote to memory of 1324	1260	5fbd8561540a6246de5e402214da86d0.exe	WerFault.exe
PID 1260 wrote to memory of 1324	1260	5fbd8561540a6246de5e402214da86d0.exe	WerFault.exe
PID 1260 wrote to memory of 1324	1260	5fbd8561540a6246de5e402214da86d0.exe	WerFault.exe
PID 1260 wrote to memory of 1324	1260	5fbd8561540a6246de5e402214da86d0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5fbd8561540a6246de5e402214da86d0.exe
"C:\Users\Admin\AppData\Local\Temp\5fbd8561540a6246de5e402214da86d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 520
2⤵
- Program crash
PID:1324

memory/1260-54-0x00000000011F0000-0x0000000001200000-memory.dmp

Filesize
64KB

Download