4f4fe3c9a73cee60fbf935844887a3b860556d2c2e1e7684c5c212517162e750

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 17:52

Target

643a9947b322770d7e86798edf4d16aa_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

643a9947b322770d7e86798edf4d16aa
SHA1

7db4631160068b5d41c00f51095464702f2c88cf
SHA256

4f4fe3c9a73cee60fbf935844887a3b860556d2c2e1e7684c5c212517162e750
SHA512

06d3fd7f08cecf18d97094c8ccd88daf9d9d64faa4523a46ca1f3ae800eefa15feabf802eee50739270cd58f69e495af5bcaf76a0ab8035830e319b123ff1613
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUJ5gRt:n3vyJNRkZHBvZp0qoOCu2pkojnZHjp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	760	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 760	4672	rundll32.exe	83
PID 4672 wrote to memory of 760	4672	rundll32.exe	83
PID 4672 wrote to memory of 760	4672	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\643a9947b322770d7e86798edf4d16aa_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\643a9947b322770d7e86798edf4d16aa_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 632
    3⤵
    - Program crash
    PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 760 -ip 760
1⤵
PID:4344