d3e3d721d3f3f61a909ee5288c1d0271b8df384a09c284494870defa124b4b0a

Analysis

max time kernel
91s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 19:23

Target

2023-08-23_39f59121f330f459825ffced43af659d_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

39f59121f330f459825ffced43af659d
SHA1

b6e5ddfb569062fdaa0f0698a828875c59c1085c
SHA256

d3e3d721d3f3f61a909ee5288c1d0271b8df384a09c284494870defa124b4b0a
SHA512

00f9830f7f01500a73484d31475b4caff51ea9db01f8f113bd41fdffe22b0c2c4459e0bbd648c4fdb21cb1195d2960736f202ede85f94e95c719ba4da1a14a12
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU+Y5U:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1144 4720 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1144	4720	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4100 wrote to memory of 4720	4100	rundll32.exe	rundll32.exe
PID 4100 wrote to memory of 4720	4100	rundll32.exe	rundll32.exe
PID 4100 wrote to memory of 4720	4100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_39f59121f330f459825ffced43af659d_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_39f59121f330f459825ffced43af659d_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 632
3⤵
- Program crash
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4720 -ip 4720
1⤵
PID:3136