7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 02:59

Target

data/meterpreter/elevator.x64.dll
Size

88KB
MD5

2b6c2df1f5ff252475f4186c8bce48d5
SHA1

434dc1cca582512de355d01c5d8650fab025c163
SHA256

345c36cdd66c4e9dded155ca29ebf9ee511149e843597bad1ac8ee86ba51b41d
SHA512

443cae23dcde182f9d5c0b21266cc03ad187ae63ee917278f9281ea6f460cb0857faf91b11e633007ab8b5c21e47d6aa3251f2a9f6da0fd740116405f0e577c1
SSDEEP

1536:SUinI/YHATZcOZf8M7E9anDP2Floz7ykPVHdY8V/sW4daTm3Cc:ShIAgTSOV8M7E9anDP2SGG3gaT/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28
PID 1096 wrote to memory of 2760	1096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\elevator.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1096 -s 88
  2⤵
  PID:2760