668bf9ed54120899b86b21a8aa1df1075937b8c05cfca52817746b6e418e2006

Analysis

max time kernel
190s
max time network
305s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16-05-2024 22:30

Target

VenomRAT_v6.0.3/Plugins/x86/SQLite.Interop.dll
Size

1.3MB
MD5

730e57d00a8699352cfb15ec1159afd0
SHA1

3ce30190d1f64dcb4572f0dd0efc065d58407dd9
SHA256

29f4c07e9c5b265976967d8afe435b0e74bb6169c20090d856fbcc42a4bf48f0
SHA512

b5bbc861884d4ce0a0846688d493f7a84b97076849ab81fdf3631a525dd99a12c7156a9d43b3019f91a912ab102669b651c5f6c2967142c29d2b41e76aefd3df
SSDEEP

24576:mf/6v6+dsbLxvHMX3zaW8Z2VCGt1mGkFadPRjp5506GygUI:mn6UbEB8Z2cGRXDg/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3364 8 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3364	8	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2772 wrote to memory of 8	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 8	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 8	2772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3\Plugins\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3\Plugins\x86\SQLite.Interop.dll,#1
  2⤵
  PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 656
    3⤵
    - Program crash
    PID:3364