427e057ff2831e74919e7079efcd4a5ac47e05e6085e0a09e33292b3b3845e5d

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 18:09

Target

c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

c4ca804321608d2b5f6bc99902969f91
SHA1

647303fa86c91d812706ecaba7b80793c7984faa
SHA256

427e057ff2831e74919e7079efcd4a5ac47e05e6085e0a09e33292b3b3845e5d
SHA512

f6d2335caad4005334664acd9b714deefc261601999f88d1f73cda62f69498c05fc3d3556989563a90d47957884cbe54d44da1a1a35dae175e7575fa7fe2c810
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU0fE7Y5m:cIDff9D8C6XYRw6MT2DEjbs

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2420 2260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2420	2260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2260	2208	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 2420	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 2420	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 2420	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 2420	2260	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 232
3⤵
- Program crash
PID:2420