aa086a05b25739860bae302f719b1213e98549da2c82da2a397f9b1e42c0bb9a

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 13:30

Target

XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Size

12KB
MD5

f922206889c896cf2d86f21e9f9db7db
SHA1

046b00f2edb34982db266d903627ced283f4a5ea
SHA256

1ac4832667db7044b1077e447d587a14dcd1270e71b8d34157a77d515b61c4b3
SHA512

abe82360ab14ed1e0c0c25da46a7558638671de1701e383b7a9bc122edecbc1eb13c760835a7e626a7d3ba326d4705acb53987e61d45332027913512befc4965
SSDEEP

192:wLwX9CLPN0LjrJUMmYVY2aq3xWrhSaadrq8uSF3u:owNCLPN0/9UMme313UrhSJUSF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1688	2112	DisAsClaimer.exe	31
PID 2112 wrote to memory of 1688	2112	DisAsClaimer.exe	31
PID 2112 wrote to memory of 1688	2112	DisAsClaimer.exe	31

C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\DisAsClaimer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 516
  2⤵
  PID:1688

memory/2112-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x00000000012C0000-0x00000000012C8000-memory.dmp

Filesize
32KB

Download