9a2bf745baf56c027d7e4d52cc7c41cc7b2748d634677384fc2d9eecdb8f7485

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-04-2023 14:45

Target

XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Size

12KB
MD5

f922206889c896cf2d86f21e9f9db7db
SHA1

046b00f2edb34982db266d903627ced283f4a5ea
SHA256

1ac4832667db7044b1077e447d587a14dcd1270e71b8d34157a77d515b61c4b3
SHA512

abe82360ab14ed1e0c0c25da46a7558638671de1701e383b7a9bc122edecbc1eb13c760835a7e626a7d3ba326d4705acb53987e61d45332027913512befc4965
SSDEEP

192:wLwX9CLPN0LjrJUMmYVY2aq3xWrhSaadrq8uSF3u:owNCLPN0/9UMme313UrhSJUSF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1772 1092 WerFault.exe DisAsClaimer.exe

pid	pid_target	process	target process
1772	1092	WerFault.exe	DisAsClaimer.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DisAsClaimer.exe

description	pid	process	target process
PID 1092 wrote to memory of 1772	1092	DisAsClaimer.exe	WerFault.exe
PID 1092 wrote to memory of 1772	1092	DisAsClaimer.exe	WerFault.exe
PID 1092 wrote to memory of 1772	1092	DisAsClaimer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1092 -s 524
2⤵
- Program crash
PID:1772

memory/1092-54-0x0000000001220000-0x0000000001228000-memory.dmp

Filesize
32KB

Download