asyncrat | 21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 01:11

Target

21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe
Size

56.9MB
MD5

e0ecb4f91e8647feea8edeb29307ef5f
SHA1

eaff61326730ef630271faa1eb2d4bed89f600cb
SHA256

21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a
SHA512

2a7d31cc0fb0965611cf8e5cd36e2706bd9416b152fb84f2e88258e00535be3aabe75fdfc887eccf0041082b0448e40647ebd3e12fce43432d143b82e3e387f9
SSDEEP

1572864:jvsMfJSzNgLFS26LBmMZ9/AS7twJtyZ4:jvrfJqgFSjdmMZ9/ASKTyZ

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1404 2292 WerFault.exe 21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe

pid	pid_target	process	target process
1404	2292	WerFault.exe	21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe

description	pid	process	target process
PID 2292 wrote to memory of 1404	2292	21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe	WerFault.exe
PID 2292 wrote to memory of 1404	2292	21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe	WerFault.exe
PID 2292 wrote to memory of 1404	2292	21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe	WerFault.exe
PID 2292 wrote to memory of 1404	2292	21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe
"C:\Users\Admin\AppData\Local\Temp\21f12474163a4675e64ea397f8c3ada65308f5ef3d39d81a50fc79f31243f37a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 824
  2⤵
  - Program crash
  PID:1404

memory/2292-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x0000000000FC0000-0x00000000048B4000-memory.dmp

Filesize
57.0MB

Download
memory/2292-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-3-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-4-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2292-5-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download