ea93fc99df3d217de117871fb343537740750a154c10463c256503ed287bd923

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-09-2023 10:18

Target

2023-08-22_8fd41d596fcb7c5a352ebea3cb014b96_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

8fd41d596fcb7c5a352ebea3cb014b96
SHA1

749f3520dae255926db18eeac9a7cacbea671e68
SHA256

ea93fc99df3d217de117871fb343537740750a154c10463c256503ed287bd923
SHA512

fdefbcd5196a239569c556f279fbaa6fd5d8f324ef307fef80c3807f0c56aa6c5b08e9097e5b3f7aeb0a61c978f97cf26d047a3a768d0677e08f0cbd298f981e
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdUF5IH:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1228 1944 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1228	1944	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 1944	1792	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1228	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1228	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1228	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1228	1944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_8fd41d596fcb7c5a352ebea3cb014b96_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_8fd41d596fcb7c5a352ebea3cb014b96_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 232
3⤵
- Program crash
PID:1228