metasploit | 85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 00:44

Target

85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f.exe
Size

188KB
MD5

178fc93474f0bdd24ae762700c4c33d2
SHA1

77d0d9f41c6dfc6df7eab1bf22bc09545bdc9bfc
SHA256

85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f
SHA512

88d0dd5cc2185b96212ccc4cb7d208868f963527f026e35ddb1a5c344d4299fbe322fa3c52833653591729cc488e49dc3faf210961039294bbb53393c0b755d6
SSDEEP

3072:1zqTC/VXu6wge0Nc8QsCnE9qc7D8eVSJAGG0/4xCgv395joFcg7pSatYdQt:BqGdXu6wL0Nc8QsiHQ8ekJAG2xRv39a7

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1692	1748	WerFault.exe	85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f.exe
920	1748	WerFault.exe	85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f.exe

C:\Users\Admin\AppData\Local\Temp\85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f.exe
"C:\Users\Admin\AppData\Local\Temp\85634da7c09ce39b72fd0fac2b3edd2d352a51f3a62f5edabd207285052fd22f.exe"
1⤵
PID:1748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 260
  2⤵
  - Program crash
  PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 268
  2⤵
  - Program crash
  PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1748 -ip 1748
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1748 -ip 1748
1⤵
PID:2832

memory/1748-0-0x0000000000400000-0x0000000000433C88-memory.dmp

Filesize
207KB

Download
memory/1748-1-0x0000000000400000-0x0000000000433C88-memory.dmp

Filesize
207KB

Download