427e057ff2831e74919e7079efcd4a5ac47e05e6085e0a09e33292b3b3845e5d

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 18:09

Target

c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

c4ca804321608d2b5f6bc99902969f91
SHA1

647303fa86c91d812706ecaba7b80793c7984faa
SHA256

427e057ff2831e74919e7079efcd4a5ac47e05e6085e0a09e33292b3b3845e5d
SHA512

f6d2335caad4005334664acd9b714deefc261601999f88d1f73cda62f69498c05fc3d3556989563a90d47957884cbe54d44da1a1a35dae175e7575fa7fe2c810
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU0fE7Y5m:cIDff9D8C6XYRw6MT2DEjbs

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4804 1208 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4804	1208	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4572 wrote to memory of 1208	4572	rundll32.exe	rundll32.exe
PID 4572 wrote to memory of 1208	4572	rundll32.exe	rundll32.exe
PID 4572 wrote to memory of 1208	4572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4ca804321608d2b5f6bc99902969f91_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 632
3⤵
- Program crash
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1208 -ip 1208
1⤵
PID:4064