8a7d20fb5bc7ef8b02ab6e11ef78ebc0a31ba5376bd97d40fe5d1da521324556

Resubmissions

08-06-2024 18:20

08-06-2024 18:17

08-06-2024 18:11

19-05-2024 22:48

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 18:11

Target

XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Size

12KB
MD5

f922206889c896cf2d86f21e9f9db7db
SHA1

046b00f2edb34982db266d903627ced283f4a5ea
SHA256

1ac4832667db7044b1077e447d587a14dcd1270e71b8d34157a77d515b61c4b3
SHA512

abe82360ab14ed1e0c0c25da46a7558638671de1701e383b7a9bc122edecbc1eb13c760835a7e626a7d3ba326d4705acb53987e61d45332027913512befc4965
SSDEEP

192:wLwX9CLPN0LjrJUMmYVY2aq3xWrhSaadrq8uSF3u:owNCLPN0/9UMme313UrhSJUSF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DisAsClaimer.exe

description	pid	process	target process
PID 808 wrote to memory of 2012	808	DisAsClaimer.exe	WerFault.exe
PID 808 wrote to memory of 2012	808	DisAsClaimer.exe	WerFault.exe
PID 808 wrote to memory of 2012	808	DisAsClaimer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 808 -s 520
  2⤵
  PID:2012

memory/808-0-0x000007FEF5933000-0x000007FEF5934000-memory.dmp

Filesize
4KB

Download
memory/808-1-0x00000000010C0000-0x00000000010C8000-memory.dmp

Filesize
32KB

Download
memory/808-2-0x000007FEF5933000-0x000007FEF5934000-memory.dmp

Filesize
4KB

Download