f1b29eb453c9a878dd354c3eee2a6ba904e87e9694b714cc6cc45dfc992f9ea7

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 18:17

Target

fb0012cc5ba60b709886bdb4eed46b0c_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

fb0012cc5ba60b709886bdb4eed46b0c
SHA1

54176bdca631b10b0cd752c30838f3e82dde4f2e
SHA256

f1b29eb453c9a878dd354c3eee2a6ba904e87e9694b714cc6cc45dfc992f9ea7
SHA512

cc6018b92717f7c022e3c8089b10143f86cf3184ad1e38420689693e80498f146b38fd349a5eb7f1ce44cc381b5cd50124d9bec1dddb404e34785f6a598a4654
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUMS5Gw:n3vyJNRkZHBvZp0qoOCu2pkojnZHj1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2864	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 272 wrote to memory of 2864	272	rundll32.exe	28
PID 2864 wrote to memory of 2868	2864	rundll32.exe	29
PID 2864 wrote to memory of 2868	2864	rundll32.exe	29
PID 2864 wrote to memory of 2868	2864	rundll32.exe	29
PID 2864 wrote to memory of 2868	2864	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb0012cc5ba60b709886bdb4eed46b0c_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb0012cc5ba60b709886bdb4eed46b0c_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 232
    3⤵
    - Program crash
    PID:2868