8a7d20fb5bc7ef8b02ab6e11ef78ebc0a31ba5376bd97d40fe5d1da521324556

Resubmissions

08/06/2024, 18:20

08/06/2024, 18:17

08/06/2024, 18:11

19/05/2024, 22:52

19/05/2024, 22:48

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 18:11

Target
XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Size 12KB
Sample240608-ws439seb9v
SHA256 1ac4832667db7044b1077e447d587a14dcd1270e71b8d34157a77d515b61c4b3
MD5 f922206889c896cf2d86f21e9f9db7db
SHA1 046b00f2edb34982db266d903627ced283f4a5ea
SHA512 abe82360ab14ed1e0c0c25da46a7558638671de1701e383b7a9bc122edecbc1eb13c760835a7e626a7d3ba326d4705acb53987e61d45332027913512befc4965
SSDEEP 192:wLwX9CLPN0LjrJUMmYVY2aq3xWrhSaadrq8uSF3u:owNCLPN0/9UMme313UrhSJUSF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2012	808	DisAsClaimer.exe	29
PID 808 wrote to memory of 2012	808	DisAsClaimer.exe	29
PID 808 wrote to memory of 2012	808	DisAsClaimer.exe	29

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 808 -s 520
  2⤵
  PID:2012

memory/808-0-0x000007FEF5933000-0x000007FEF5934000-memory.dmp

Download

memory/808-1-0x00000000010C0000-0x00000000010C8000-memory.dmp

Download

memory/808-2-0x000007FEF5933000-0x000007FEF5934000-memory.dmp

Download