metasploit | a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 02:17

Target

a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18.exe
Size

34KB
MD5

3f69a87cb4bde9c863f39301eb1f29c8
SHA1

3c9de5d2605eb4419fe38c1728e97b6e7a9057ef
SHA256

a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18
SHA512

d9fa11922158349c540adbd9a9e44062e42f7a5e9372ed89194554d536be186e239e254a2dac1fa40e8caace13c815e5f7a0d35fbd7007f251e5a8462408774d
SSDEEP

384:sckalfdKxiis5iHo40IKYb93V5XiVOcvbvx0fAmwD6:xlkxiihHo4fb93b4TvbOpq6

Score

10^/10

Family

metasploit

Version

metasploit_stager

124.221.70.199:8762

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1220	3012	a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18.exe	21
PID 1220 wrote to memory of 2620	1220	Explorer.EXE	32
PID 1220 wrote to memory of 2620	1220	Explorer.EXE	32
PID 1220 wrote to memory of 2620	1220	Explorer.EXE	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18.exe
  "C:\Users\Admin\AppData\Local\Temp\a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1220 -s 1080
  2⤵
  PID:2620

memory/1220-0-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1220-1-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download