aa086a05b25739860bae302f719b1213e98549da2c82da2a397f9b1e42c0bb9a

Analysis

max time kernel
23s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 13:30

Target

XWorm-Rat-Remote-Administration-Tool--main/dnlib.exe
Size

12KB
MD5

013965d8a511aec735b069e3ec027d4f
SHA1

f2673470953b247525a6a54e53417fd844b0e816
SHA256

27f8adbfd40471340ecf13950e143c0fdc7acade26458edf99781b4138cd4a02
SHA512

fa0e8a2e78c34e6e6b3ab4c225f6c08356e024d900fdc6d3bcc69beb57a17c6c205a34c155d9766917b2fe769415fc4232fcdc9c0f7807c9c0c61ecd7bb13016
SSDEEP

192:CFLcpUO6T4Y1e/T0YmYV52ZYu3hQWreHaadrq8uSF3:CFL6UZT4Y1OT0YmeoZ33h1reHJUSF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1472	2508	dnlib.exe	30
PID 2508 wrote to memory of 1472	2508	dnlib.exe	30
PID 2508 wrote to memory of 1472	2508	dnlib.exe	30

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\dnlib.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\dnlib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 516
  2⤵
  PID:1472

memory/2508-0-0x000007FEF6523000-0x000007FEF6524000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x0000000000C10000-0x0000000000C18000-memory.dmp

Filesize
32KB

Download
memory/2508-2-0x000007FEF6523000-0x000007FEF6524000-memory.dmp

Filesize
4KB

Download