9a2bf745baf56c027d7e4d52cc7c41cc7b2748d634677384fc2d9eecdb8f7485

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-04-2023 14:45

Target

XWorm-Rat-Remote-Administration-Tool--main/dnlib.exe
Size

12KB
MD5

6967b97ce4ff4524883a196a97736275
SHA1

6fdf2b9adc16b40a06bacc7db0abee917ef4abd3
SHA256

e2bddf56324addac02678a7fd8d9c3da24ad55132883ad826a1a60eaf4e4a034
SHA512

c71525d49e36975cb43535cff5176409163b14f53b644e3d161fd56f7514f0affbda051541a07d9af4cdc45a564dfad20a23584701499a0f03e531219c9f72be
SSDEEP

192:zLlo6IXsbK9CLPN0LWyJUMmYVY2QQq33WrmRaadrq8uSF3:PljIeyCLPN0CUUMme3o3mrmRJUSF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1752 1196 WerFault.exe dnlib.exe

pid	pid_target	process	target process
1752	1196	WerFault.exe	dnlib.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dnlib.exe

description	pid	process	target process
PID 1196 wrote to memory of 1752	1196	dnlib.exe	WerFault.exe
PID 1196 wrote to memory of 1752	1196	dnlib.exe	WerFault.exe
PID 1196 wrote to memory of 1752	1196	dnlib.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\dnlib.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\dnlib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1196 -s 528
2⤵
- Program crash
PID:1752

memory/1196-54-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Filesize
32KB

Download