8e44011434dd980079f54ad9d2b5dc3994ea0907afa91efe5bb0ad378b8ac5e2

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 13:55

Target

a29a1c40ce8d72e25bfdd4413a86241a_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

a29a1c40ce8d72e25bfdd4413a86241a
SHA1

bd97cffc36dea95d3035d06fc3e0ba7d2af371e7
SHA256

8e44011434dd980079f54ad9d2b5dc3994ea0907afa91efe5bb0ad378b8ac5e2
SHA512

d87d9a49d4b3ecb480c5ee781a9caa17cf3e860da56872ea780f590a58f5c334a23b75a840a7d72974a36977980b3089355e4b6e82d6541c9287c84de3541d5e
SSDEEP

3072:ICW0Y9Z38EpJgWHKsixnImG9XSjUjoAN6WCH0eRFj8UO5J:OvzgWUwXSQN+H0ej

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2160	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 1832 wrote to memory of 2160	1832	rundll32.exe	28
PID 2160 wrote to memory of 2544	2160	rundll32.exe	29
PID 2160 wrote to memory of 2544	2160	rundll32.exe	29
PID 2160 wrote to memory of 2544	2160	rundll32.exe	29
PID 2160 wrote to memory of 2544	2160	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a29a1c40ce8d72e25bfdd4413a86241a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a29a1c40ce8d72e25bfdd4413a86241a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 196
    3⤵
    - Program crash
    PID:2544