7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 02:59

Target

data/meterpreter/ext_server_incognito.x86.dll
Size

103KB
MD5

dfbe81a7bf36b40a08b934f5735dc56f
SHA1

325ef8ab615bc9c844ec758fbeb5ab641752afbc
SHA256

3b8701266529d1e5ef1dcb55b9138d818d1affe949edce90d737293c04f79e14
SHA512

a7ac07b458b6d89140f1445b17f4cac8e7f84d35afbc1c00de212f776f8471161e26aac0f19682fa5a39cc50bce4d40f2f343c98a9b6641ee6f6a3e7a0e497b4
SSDEEP

1536:C+rrrK9P7nrQ70Zjxm2Vsu0u4zluWalbFkybJZqVUBge4Yz5+Bac+cyfvtsWjcd1:C+EPCVHpKbFpKVrPB5yikqT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1256	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 2216 wrote to memory of 1256	2216	rundll32.exe	28
PID 1256 wrote to memory of 2192	1256	rundll32.exe	29
PID 1256 wrote to memory of 2192	1256	rundll32.exe	29
PID 1256 wrote to memory of 2192	1256	rundll32.exe	29
PID 1256 wrote to memory of 2192	1256	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_incognito.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_incognito.x86.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 244
    3⤵
    - Program crash
    PID:2192