a7e7ff20f7e40a4f3de268684d4f427488b088f85c50f5d84a7db07097abea98

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 16:13

Target

9d99c52483aa9d6953f97cc6479bc363_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

9d99c52483aa9d6953f97cc6479bc363
SHA1

567e91e3d41e36f78bbce6f0fa60e072518b26be
SHA256

a7e7ff20f7e40a4f3de268684d4f427488b088f85c50f5d84a7db07097abea98
SHA512

0332557e4c873d84017c242e7d5b11f4b4452096018f83e4ed379a1e0e060babd267894394aa349cd935e48370b0f7eb2ffb50074d62d3407ac8b77a47a6ac38
SSDEEP

3072:kEgRLoFPaa+aZHVftT5fC4MtkSHy0pD/hh0UZbaLuNBR05BATwtjFURE5P:kEgsPt+aZH9DMSr0pbhyUBaLkKBATsj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29
PID 2180 wrote to memory of 2212	2180	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d99c52483aa9d6953f97cc6479bc363_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d99c52483aa9d6953f97cc6479bc363_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:2212