7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 02:59

Target

data/meterpreter/ext_server_espia.x86.dll
Size

198KB
MD5

827d7088577ae38b1a5b7d065e206f87
SHA1

b578c44dffb867cc74a30c4ee129741ae9c5cfcc
SHA256

ddfc94a4eabe54ce8036ed081756ea5d9ecda89565b77d0143ee842a9d05131f
SHA512

ed00d5b469b59ecd5246453c7097be6d8239972014bb368f47bbff2e64844b2251269b6ded702fb008b5f347a660177f12abe99e6250b0469d85de6dbadaba3b
SSDEEP

3072:aKxphNiufd9Al6I4WWCUy4wd6wAsliJvS2/HfUgMgz1R4:aK73iWAl6I4WWCUy4wd6wA7r/HXMv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
692	232	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 232	1008	rundll32.exe	83
PID 1008 wrote to memory of 232	1008	rundll32.exe	83
PID 1008 wrote to memory of 232	1008	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_espia.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_espia.x86.dll,#1
  2⤵
  PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 640
    3⤵
    - Program crash
    PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 232 -ip 232
1⤵
PID:4424