asyncrat | 406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/07/2024, 00:13

Target

5567263b52d17123678de6b0b82e01be_JaffaCakes118.exe
Size

42KB
MD5

5567263b52d17123678de6b0b82e01be
SHA1

7833228837d04bfdf38c2cec525ad715a0f79e63
SHA256

406b09d35a24102b916fb7dd44e573f480796047cb5cde313e4a48c2cd73fc6d
SHA512

79c01268cfe0a730b87ba4fb9feb3960b1f3383ffbc55ff4a8fad3b5b239f526446525c14eff482b400fe7579e04c5d0630bf61b848bf506ac3e0f748bdefb51
SSDEEP

768:t1zdCUT0aIvzImZahaMdEf/VoDCOz9eKjbegp1NL5n:D34aazHUef/VbOReGbegbHn

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2552	2968	5567263b52d17123678de6b0b82e01be_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2552	2968	5567263b52d17123678de6b0b82e01be_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2552	2968	5567263b52d17123678de6b0b82e01be_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5567263b52d17123678de6b0b82e01be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5567263b52d17123678de6b0b82e01be_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2968 -s 508
  2⤵
  PID:2552

memory/2968-0-0x000007FEF5053000-0x000007FEF5054000-memory.dmp

Filesize
4KB

Download
memory/2968-1-0x000000013FE30000-0x000000013FE40000-memory.dmp

Filesize
64KB

Download
memory/2968-2-0x000007FEF5053000-0x000007FEF5054000-memory.dmp

Filesize
4KB

Download