137e9cd0e39cb188005c88bbaea2c5b493092aaab4d6e161bc0e8ab2e4ccadb7

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 15:46

Target

58470c72adfc961bfa7a2253c00dd5a2_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

204KB
MD5

58470c72adfc961bfa7a2253c00dd5a2
SHA1

4e947466348ad2f1951588c7d13ffb33875fad99
SHA256

137e9cd0e39cb188005c88bbaea2c5b493092aaab4d6e161bc0e8ab2e4ccadb7
SHA512

93e942b2fdc6e7d1f86b47bacbae3bfdbaa0cd837b84bd5c8ff3083558decce515f2bd6a5f52d7032f1356cfa4649e86167b8779da1bea7a2d53ff5f709dd82a
SSDEEP

3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUl5SRI:FRYkcrY4MCIt07iPlvU0j

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2220 2236 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2220	2236	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2236	2204	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2220	2236	rundll32.exe	WerFault.exe
PID 2236 wrote to memory of 2220	2236	rundll32.exe	WerFault.exe
PID 2236 wrote to memory of 2220	2236	rundll32.exe	WerFault.exe
PID 2236 wrote to memory of 2220	2236	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58470c72adfc961bfa7a2253c00dd5a2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58470c72adfc961bfa7a2253c00dd5a2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 232
3⤵
- Program crash
PID:2220