137e9cd0e39cb188005c88bbaea2c5b493092aaab4d6e161bc0e8ab2e4ccadb7

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2023 15:46

Target

58470c72adfc961bfa7a2253c00dd5a2_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

204KB
MD5

58470c72adfc961bfa7a2253c00dd5a2
SHA1

4e947466348ad2f1951588c7d13ffb33875fad99
SHA256

137e9cd0e39cb188005c88bbaea2c5b493092aaab4d6e161bc0e8ab2e4ccadb7
SHA512

93e942b2fdc6e7d1f86b47bacbae3bfdbaa0cd837b84bd5c8ff3083558decce515f2bd6a5f52d7032f1356cfa4649e86167b8779da1bea7a2d53ff5f709dd82a
SSDEEP

3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUl5SRI:FRYkcrY4MCIt07iPlvU0j

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3052 1104 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3052	1104	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2832 wrote to memory of 1104	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1104	2832	rundll32.exe	rundll32.exe
PID 2832 wrote to memory of 1104	2832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58470c72adfc961bfa7a2253c00dd5a2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58470c72adfc961bfa7a2253c00dd5a2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 632
3⤵
- Program crash
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1104 -ip 1104
1⤵
PID:5096