8fb0ce88b39069c7424c64ab9d30b3b8daa5da9fdb72a52d31f45b494a8eadcd

Analysis

max time kernel
11s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:20

Target

data/meterpreter/elevator.x64.dll
Size

89KB
MD5

ff20de19c78752343ff3f0670da4950c
SHA1

3871187992eb0fe0fd93c041c30a58b5e953e33c
SHA256

becb04ccb00a2cb6c796d2601d02471932f5393c350456ff22eca2e1e748fa48
SHA512

f346d834610b9183323d2fefb09a5ae00f033ee4c60d1d566a8f6be95db686c041c5af75a888dc3ac34c9f1500fed9e768da9b4b12739cd1611f0c61258e8d82
SSDEEP

1536:4kCfIgAH4TPRcbpf8Ej01Cv7u2FlYz7yv/NXdHY8VwsW4dFnR:4xQnYTybF8Ej01Cv7u2iWv3vFnR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2036	560	rundll32.exe	29
PID 560 wrote to memory of 2036	560	rundll32.exe	29
PID 560 wrote to memory of 2036	560	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\elevator.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 560 -s 92
  2⤵
  PID:2036