8fb0ce88b39069c7424c64ab9d30b3b8daa5da9fdb72a52d31f45b494a8eadcd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:20

Target

data/meterpreter/ext_server_espia.x64.dll
Size

195KB
MD5

b3d00110a7bd4693e2dd6ba5f5a59623
SHA1

0493e2ceb57ff477276fea1ea817795fecc6dd97
SHA256

1a7cc8400302950f745ef5980d0047b1aacf52f9671d8b7f08d81b4765421738
SHA512

fc4a169a0ea384b683bb2d48420e08d286a891f895638711c6a2e612e97225c5f36b22b62ac211be95ac1c4a89f0a33256e15e6e85a89c64b605d7729e768913
SSDEEP

6144:oS4lggQ4BZrd6T0HTNNKjdJew9VTa4zwlL050bYpKcy:oHS2TNIjDn9YIwK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28
PID 1716 wrote to memory of 2904	1716	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_espia.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1716 -s 88
  2⤵
  PID:2904