668bf9ed54120899b86b21a8aa1df1075937b8c05cfca52817746b6e418e2006

Analysis

max time kernel
302s
max time network
323s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16-05-2024 22:30

Target

VenomRAT_v6.0.3/System.ServiceModel.Internals.dll
Size

804KB
MD5

7f35e0251f45807e872ee0a354a8fe81
SHA1

74cebb21cb95165774ea0ab082cb85cd3458ca8d
SHA256

805d9e2c5cd2f2b17e68763ae4eb1db0103bd278e526de32f98e0cd336541e14
SHA512

c5dfd9e43295b786eae9869ac1ede564d9d86255a58b3cf2f9af313c355fab8d5c3c4bd41291da65729ae510000446290588e9d67b2e65aa6da10777c6f5d38b
SSDEEP

12288:Nk6q80n+FoAY2aScs0pbpcCqunbh9Xj9OtCXK0VWLmYss:snhATaScs0pmCq8YtCXp8mYs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2404 wrote to memory of 2520	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2520	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 2520	2404	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3\System.ServiceModel.Internals.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT_v6.0.3\System.ServiceModel.Internals.dll,#1
  2⤵
  PID:2520