3acce18fa1327b1e89c47997fe1da62a86a1211d893f5128b4c59fa44d57b335

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/01/2025, 00:20 UTC

Target

WARZONE RAT 3.03/Datas/rdpwrap64.dll
Size

150KB
MD5

c4063372afe486d5e9a11c5b68e0524f
SHA1

9f9da8d10f3a2f6f17dffdf45b5b90e094ad30f6
SHA256

fc1f3fc182cef9bcef5192e4fa4569697e27852cbffb7a55ea6118c603ddc420
SHA512

6286914126dd16600797f5741bfa6a56e0ade32913385beed822bf6186f74c53fa607597a30a31868d0e5493524bd4cdea41c54e3fa2fa2cbb9d23366b5661e3
SSDEEP

3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVsXDPtD05aw:oMjTiVw2ve9LBMMpJsT+lCa

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	rundll32.exe
1696	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\Datas\rdpwrap64.dll",#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696

C:\rdpwrap.txt

Filesize
430B

MD5
9724186d86fcbc3c434198a337b6b0f2

SHA1
ec82ac778d9ee1b33707ed2dd3231c13c1fc1f03

SHA256
e7f9cf5900d61939b61182bf837ec0bfe963e6fb9fdaac9a712c6542e399e383

SHA512
c03c6bdf738d10c79b0a1e07c549493bfeaced4630ba2051efe1c0f6248a4450fed276d090f4c625f291f67dcb1195cba134cb73d0271200ffad4a47ccada269

Download Submit