metasploit | 523f9f7223b71322ac50ac560177dd187f56cdf157c04a8ebe37df773d20a066

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 11:14

Target
8c2f560cf4c0f5a2856f37d8542e35d5.dll
Size 48KB
Sample240203-nb9y7aaafm
SHA256 523f9f7223b71322ac50ac560177dd187f56cdf157c04a8ebe37df773d20a066
MD5 8c2f560cf4c0f5a2856f37d8542e35d5
SHA1 e40693842d309c3c96d597ccf5c0ca7339ba75c5
SHA512 ad6a5ff560a6ad94bcf8dd6d8ba8a20da034aa8eb45d090e5d87d869801bc5dede886089151465f87853abfe122a774a0dc3f4d5f2802c411e157ce18846abc8
SSDEEP 1536:j4XxFoiPDC7tKq4+zXUyXH4REFYVKACAMC:j4BCirmDTH4REYVKAuC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2700	4032	rundll32.exe	85
PID 4032 wrote to memory of 2700	4032	rundll32.exe	85
PID 4032 wrote to memory of 2700	4032	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c2f560cf4c0f5a2856f37d8542e35d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c2f560cf4c0f5a2856f37d8542e35d5.dll,#1
  2⤵
  PID:2700

memory/2700-1-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Download

memory/2700-0-0x0000000000B20000-0x0000000000B60000-memory.dmp

Download

memory/2700-3-0x0000000000B20000-0x0000000000B60000-memory.dmp

Download

memory/2700-4-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Download