394b344b50bb193330fa034f5f4ccd6d88d4e66460465f9a415736391d60af21

Analysis

max time kernel
61s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 09:33

Target

Silver RAT V1.0/libs/softokn3.dll
Size

251KB
MD5

4e52d739c324db8225bd9ab2695f262f
SHA1

71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256

74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512

2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP

6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3152 4992 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3152	4992	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1344 wrote to memory of 4992	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 4992	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 4992	1344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silver RAT V1.0\libs\softokn3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Silver RAT V1.0\libs\softokn3.dll",#1
2⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 644
3⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4992 -ip 4992
1⤵
PID:2520