1e7324d7b68b956cf45af8303f8854db1be7557e797f3ea08d38e7d7fd463372

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2023, 11:05

Target

2023-08-22_9e1c052bfaec9c2c77776ca33c2f8954_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

206KB
MD5

9e1c052bfaec9c2c77776ca33c2f8954
SHA1

228dd947b6111e067cce257c5f17ac14df27ecd1
SHA256

1e7324d7b68b956cf45af8303f8854db1be7557e797f3ea08d38e7d7fd463372
SHA512

925807febdf58f959cd44267ebead281c3d957c8ded56c71dd03e8631024fbc04d3a8f5eed7d158380ffe88daaecd8d078c858ea922e4b96fc2798110a2cdf97
SSDEEP

3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUu5+Gj:ZwXupN1x8CgBbRLDTuLj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4224	208	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 208	3520	rundll32.exe	83
PID 3520 wrote to memory of 208	3520	rundll32.exe	83
PID 3520 wrote to memory of 208	3520	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_9e1c052bfaec9c2c77776ca33c2f8954_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_9e1c052bfaec9c2c77776ca33c2f8954_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 632
    3⤵
    - Program crash
    PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
1⤵
PID:944