8fb0ce88b39069c7424c64ab9d30b3b8daa5da9fdb72a52d31f45b494a8eadcd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:20

Target

data/meterpreter/ext_server_extapi.x64.dll
Size

151KB
MD5

71824f738e185f67d2fd477375b7243e
SHA1

486b48fd6074eb9db949fdf3a88124cfee8a9aca
SHA256

aac25cb83c2d283b12c859400af4f773f8510546e7933668db9f0b43f998cce0
SHA512

945beb7db304e7337f250e9c05217ec677bdb666f70e0898d94806fa7e39cf238b774bbf2f66c7592faaaa7c774c9120da36191e74df01617c01cc808585cf46
SSDEEP

3072:CNUrPpk8wLmv2s9TpERBEe0i2zwBW9obFY7DRf:PrPC8wk2wTwEj5sBh6f

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2340	2488	rundll32.exe	31
PID 2488 wrote to memory of 2340	2488	rundll32.exe	31
PID 2488 wrote to memory of 2340	2488	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_extapi.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2488 -s 152
  2⤵
  PID:2340