ea93fc99df3d217de117871fb343537740750a154c10463c256503ed287bd923

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 10:18

Target

2023-08-22_8fd41d596fcb7c5a352ebea3cb014b96_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

8fd41d596fcb7c5a352ebea3cb014b96
SHA1

749f3520dae255926db18eeac9a7cacbea671e68
SHA256

ea93fc99df3d217de117871fb343537740750a154c10463c256503ed287bd923
SHA512

fdefbcd5196a239569c556f279fbaa6fd5d8f324ef307fef80c3807f0c56aa6c5b08e9097e5b3f7aeb0a61c978f97cf26d047a3a768d0677e08f0cbd298f981e
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdUF5IH:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 1812 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2192	1812	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4740 wrote to memory of 1812	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1812	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1812	4740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_8fd41d596fcb7c5a352ebea3cb014b96_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-22_8fd41d596fcb7c5a352ebea3cb014b96_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 632
3⤵
- Program crash
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1812 -ip 1812
1⤵
PID:180