1e7324d7b68b956cf45af8303f8854db1be7557e797f3ea08d38e7d7fd463372

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 11:05

Target

2023-08-22_9e1c052bfaec9c2c77776ca33c2f8954_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

206KB
MD5

9e1c052bfaec9c2c77776ca33c2f8954
SHA1

228dd947b6111e067cce257c5f17ac14df27ecd1
SHA256

1e7324d7b68b956cf45af8303f8854db1be7557e797f3ea08d38e7d7fd463372
SHA512

925807febdf58f959cd44267ebead281c3d957c8ded56c71dd03e8631024fbc04d3a8f5eed7d158380ffe88daaecd8d078c858ea922e4b96fc2798110a2cdf97
SSDEEP

3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUu5+Gj:ZwXupN1x8CgBbRLDTuLj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2180	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 1848 wrote to memory of 2180	1848	rundll32.exe	28
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29
PID 2180 wrote to memory of 2944	2180	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_9e1c052bfaec9c2c77776ca33c2f8954_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_9e1c052bfaec9c2c77776ca33c2f8954_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 232
    3⤵
    - Program crash
    PID:2944