8fb0ce88b39069c7424c64ab9d30b3b8daa5da9fdb72a52d31f45b494a8eadcd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:20

Target

data/meterpreter/ext_server_lanattacks.x64.dll
Size

220KB
MD5

823f2add6d446c0e6bfcae35ae01b71a
SHA1

cb65baee6422f38622a624d937ee6afc61ce1a9f
SHA256

c2fee6d74eb377bc8a6856530abae6187beabc214d0c45c103da1483adb89815
SHA512

510ae5b425b31f6d5c5ac1f9d64777b7923125cdc5be037cfd89ccaf171ed1731330e738e9bed67fc1f170ec399d05bcae61c940953be4246a293261a0016ebd
SSDEEP

3072:8EhXT4d1Wwxv+ooXtF/NAT2arOjpCAKhPdS9BW+sf1M696NGaF6:nYvXk2T3OjpCAodSXWp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2504	2484	rundll32.exe	30
PID 2484 wrote to memory of 2504	2484	rundll32.exe	30
PID 2484 wrote to memory of 2504	2484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_lanattacks.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 80
  2⤵
  PID:2504