asyncrat | e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae

Analysis

max time kernel
13s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 19:06

Target

e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae.exe
Size

14.0MB
MD5

60f669819957c05b9c325471fc9954f1
SHA1

404787209ff4f2d0459018bd97cf0ea4e088ab1d
SHA256

e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae
SHA512

620289ecbbb3dedc8a45042a7fb82a23f14943dbba0a1968ee8e1dbc01c1c5ee3345366ea9c827456a7a7afa6bd890dc3cae5042e30462c412a253c1beb4b11f
SSDEEP

196608:gSj6qchgMZX816FU1bYJSg7m7aIchLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95UhSN:9TBP+Zw6NLIsFfskh1BmXG0

Score

10^/10

asyncrat rat

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

resource	yara_rule
behavioral1/memory/1972-1-0x0000000000190000-0x0000000000F9A000-memory.dmp	VenomRAT

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2172	1972	e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae.exe	29
PID 1972 wrote to memory of 2172	1972	e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae.exe	29
PID 1972 wrote to memory of 2172	1972	e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae.exe	29

C:\Users\Admin\AppData\Local\Temp\e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae.exe
"C:\Users\Admin\AppData\Local\Temp\e759424059415c51ec788ace0d57e65902e053a667cf36cd2aa76734118562ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 540
  2⤵
  PID:2172

memory/1972-0-0x000007FEF5893000-0x000007FEF5894000-memory.dmp

Filesize
4KB

Download
memory/1972-1-0x0000000000190000-0x0000000000F9A000-memory.dmp

Filesize
14.0MB

Download
memory/1972-2-0x000007FEF5893000-0x000007FEF5894000-memory.dmp

Filesize
4KB

Download