metasploit | 4bcfa943e5fe15708c5e223706f06003354cb8280590d76d5c01201b0e7d6914

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2024, 04:24

Target
6c586b6670067e9f7eb43599de49fa12.exe
Size 72KB
Sample240121-e1wnesehd5
SHA256 4bcfa943e5fe15708c5e223706f06003354cb8280590d76d5c01201b0e7d6914
MD5 6c586b6670067e9f7eb43599de49fa12
SHA1 a73367fd8ef4f8016179f586e6bf242004eede62
SHA512 054457e22de90e2cf349b8f89e5cad80c2b6937ab6058df51eddc369da821053a4ab0a762ec55d074f57c6bdf6db994dafc6faf5e76ac2272a4dcb26c6360f62
SSDEEP 1536:IduKO789nVDQf9WSLI2C6wKPCGod+SbDMb+KR0Nc8QsJq39:daVDQUSLvwK5dSbDe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4840	4592	6c586b6670067e9f7eb43599de49fa12.exe	95
PID 4592 wrote to memory of 4840	4592	6c586b6670067e9f7eb43599de49fa12.exe	95
PID 4592 wrote to memory of 4840	4592	6c586b6670067e9f7eb43599de49fa12.exe	95

C:\Users\Admin\AppData\Local\Temp\6c586b6670067e9f7eb43599de49fa12.exe
"C:\Users\Admin\AppData\Local\Temp\6c586b6670067e9f7eb43599de49fa12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:4840

memory/4592-0-0x0000000000590000-0x0000000000591000-memory.dmp

Download