15f237d42968bb43de74e4a164b511efadd9864f5ee94fadbb8fd207dd59eaa5

Resubmissions

16/02/2023, 11:59

09/02/2023, 14:32

max time kernel
226s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 14:32

Target
2023-02-09_b3da6f8cfd89a27b1e7346f1d3ccd370_cobaltstrike.dll
Size 208KB
Sample230209-rwb5faff85
SHA256 15f237d42968bb43de74e4a164b511efadd9864f5ee94fadbb8fd207dd59eaa5
MD5 b3da6f8cfd89a27b1e7346f1d3ccd370
SHA1 b48042611e1249a729315d8047112ec88a311c18
SHA512 fa84dc6d828e3ee9b5ef66b307366a743e1b7d651f068283b3844d17787c77eb48b95d52a8f9d022f04a507c105344da03c706e1799ab6e36e996da04143a9ef
SSDEEP 6144:m443XR4SH8CWBeBxi66thkbAzLks1YarGR8ej4rC5Jju:ucLMBIz+YLks1YarGR8PWju
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3924	4344	rundll32.exe	80
PID 4344 wrote to memory of 3924	4344	rundll32.exe	80
PID 4344 wrote to memory of 3924	4344	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-02-09_b3da6f8cfd89a27b1e7346f1d3ccd370_cobaltstrike.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-02-09_b3da6f8cfd89a27b1e7346f1d3ccd370_cobaltstrike.dll,#1
  2⤵
  PID:3924

memory/3924-133-0x0000000010000000-0x0000000010472000-memory.dmp

Download