a9ca7cef581ef414f1e14589b0af174b21c170d760c40b4e18e88e85b158d35d | Triage

Analysis

max time kernel
19s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 22:09

Sharing

Report Analysis Logs

General

Target

AsyncRAT/Compiler.exe
Size

35KB
MD5

a199404323bde09f8fd1de83acf6c347
SHA1

189f69f8b68794187b4e0b934094a6e1e6872cc1
SHA256

26f77e60b068688199c48b270b1a0507eae287c4877f1d7f6cc9d2ce9cb51ef4
SHA512

689ad513f1e78edfd1221e9ea5ed894d8ca6d2f8384a0508eec0483697eced51530324df74890049fab084fa375026a03ac075274bde04f21b18dcfc73f5787b
SSDEEP

768:s4KUggoz8KkmtyRaAI3XIOsWrXbOfq1Tk5Rd9:s4KUggoz8Kk6y8rvbOD5RH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3036	1292	Compiler.exe	30
PID 1292 wrote to memory of 3036	1292	Compiler.exe	30
PID 1292 wrote to memory of 3036	1292	Compiler.exe	30

C:\Users\Admin\AppData\Local\Temp\AsyncRAT\Compiler.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncRAT\Compiler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1292 -s 536
  2⤵
  PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x000007FEF4BD3000-0x000007FEF4BD4000-memory.dmp

Filesize
4KB

Download
memory/1292-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download