ec74d8145645c500542268d3b43dc53fa8c39ddb53e147a11eaf4bd6686eef41

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 18:33

Target

2041ab2fabeeeeb3264d9b90182a00a9_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

2041ab2fabeeeeb3264d9b90182a00a9
SHA1

a9a9478c7f74a355d1ccfd1635c53316dfd30822
SHA256

ec74d8145645c500542268d3b43dc53fa8c39ddb53e147a11eaf4bd6686eef41
SHA512

28757a2e803058b6f7174147839e134e3af0451eb3003fddae906e0a5ea48d3fe43d1e5474cebd36042fd245ff2d27ff0bb5de6986ec8d8fba52d892af8024b7
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdU45/UFm:n3vyJNRkZHBvZp0qoOCu2pkojnZHjW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	5060	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5060	3968	rundll32.exe	80
PID 3968 wrote to memory of 5060	3968	rundll32.exe	80
PID 3968 wrote to memory of 5060	3968	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2041ab2fabeeeeb3264d9b90182a00a9_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2041ab2fabeeeeb3264d9b90182a00a9_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 632
    3⤵
    - Program crash
    PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5060 -ip 5060
1⤵
PID:4024