8a7d20fb5bc7ef8b02ab6e11ef78ebc0a31ba5376bd97d40fe5d1da521324556

Resubmissions

08-06-2024 18:20

08-06-2024 18:17

08-06-2024 18:11

19-05-2024 22:48

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 18:11

Target

XWorm-Rat-Remote-Administration-Tool--main/dnlib.exe
Size

12KB
MD5

6967b97ce4ff4524883a196a97736275
SHA1

6fdf2b9adc16b40a06bacc7db0abee917ef4abd3
SHA256

e2bddf56324addac02678a7fd8d9c3da24ad55132883ad826a1a60eaf4e4a034
SHA512

c71525d49e36975cb43535cff5176409163b14f53b644e3d161fd56f7514f0affbda051541a07d9af4cdc45a564dfad20a23584701499a0f03e531219c9f72be
SSDEEP

192:zLlo6IXsbK9CLPN0LWyJUMmYVY2QQq33WrmRaadrq8uSF3:PljIeyCLPN0CUUMme3o3mrmRJUSF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dnlib.exe

description	pid	process	target process
PID 2400 wrote to memory of 2992	2400	dnlib.exe	WerFault.exe
PID 2400 wrote to memory of 2992	2400	dnlib.exe	WerFault.exe
PID 2400 wrote to memory of 2992	2400	dnlib.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\dnlib.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\dnlib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 520
  2⤵
  PID:2992

memory/2400-0-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

Filesize
4KB

Download
memory/2400-1-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/2400-2-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

Filesize
4KB

Download