f1b14b09e955ea6885f1168b9fc54d6a2df288d021e1201d22fa1b91f16b9b05

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 14:10

Target

941f82d0c3a3d3d2488f1a333e060f0e_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

941f82d0c3a3d3d2488f1a333e060f0e
SHA1

46072a97a6602593ac2a886e45ea8e136ea5ba0e
SHA256

f1b14b09e955ea6885f1168b9fc54d6a2df288d021e1201d22fa1b91f16b9b05
SHA512

ba65e93790e76d31acf740d184b99502bd8f209d7361ae9227bcb504a80890438636495d6306501fd4ae7bc2919f6b8ed70d08d3d8cd98ca190e63e004348a6c
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUaY5M:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 4108 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1092	4108	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1480 wrote to memory of 4108	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 4108	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 4108	1480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\941f82d0c3a3d3d2488f1a333e060f0e_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\941f82d0c3a3d3d2488f1a333e060f0e_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 632
3⤵
- Program crash
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4108 -ip 4108
1⤵
PID:4528