ec74d8145645c500542268d3b43dc53fa8c39ddb53e147a11eaf4bd6686eef41

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17-08-2023 18:33

Target

2041ab2fabeeeeb3264d9b90182a00a9_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

2041ab2fabeeeeb3264d9b90182a00a9
SHA1

a9a9478c7f74a355d1ccfd1635c53316dfd30822
SHA256

ec74d8145645c500542268d3b43dc53fa8c39ddb53e147a11eaf4bd6686eef41
SHA512

28757a2e803058b6f7174147839e134e3af0451eb3003fddae906e0a5ea48d3fe43d1e5474cebd36042fd245ff2d27ff0bb5de6986ec8d8fba52d892af8024b7
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdU45/UFm:n3vyJNRkZHBvZp0qoOCu2pkojnZHjW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2360	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2472 wrote to memory of 2360	2472	rundll32.exe	28
PID 2360 wrote to memory of 2296	2360	rundll32.exe	29
PID 2360 wrote to memory of 2296	2360	rundll32.exe	29
PID 2360 wrote to memory of 2296	2360	rundll32.exe	29
PID 2360 wrote to memory of 2296	2360	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2041ab2fabeeeeb3264d9b90182a00a9_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2041ab2fabeeeeb3264d9b90182a00a9_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 232
    3⤵
    - Program crash
    PID:2296