ee1c0ab7bfa9ae150aee662fc44ad7a84ddb59d8a1d56c650c991131d28c4e5e

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 13:44

Target

a803a5a5014b25a306e3615dc1d94fc3_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

a803a5a5014b25a306e3615dc1d94fc3
SHA1

162a3642ae1fc66e9007b671c7f76b2acc060e8d
SHA256

ee1c0ab7bfa9ae150aee662fc44ad7a84ddb59d8a1d56c650c991131d28c4e5e
SHA512

6621be8a5d4fca932543b65dd2813126c617524d911ec8ae24a20b61e1bc37d4513ff418bdf9fb8f418647af17e1d8b634ffa335074ef37e2b665dc1389b4c48
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUVY54i1:LIDff9D8C6XYRw6MT2DEjN1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	1624	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1624	4928	rundll32.exe	82
PID 4928 wrote to memory of 1624	4928	rundll32.exe	82
PID 4928 wrote to memory of 1624	4928	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a803a5a5014b25a306e3615dc1d94fc3_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a803a5a5014b25a306e3615dc1d94fc3_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 632
    3⤵
    - Program crash
    PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1624 -ip 1624
1⤵
PID:4592