35325df62e55a89577dbfde72098192f1c57d6e85e922608577b22c7b2b4d44c

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2023 17:43

Target

2023-08-23_7babd9277f60db75e161e4125248e4ba_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

7babd9277f60db75e161e4125248e4ba
SHA1

7590002d0c68e7b86ddc27e6b79578eae1c28183
SHA256

35325df62e55a89577dbfde72098192f1c57d6e85e922608577b22c7b2b4d44c
SHA512

dd60e1a50b3cf1569430fd5995d8fa40f0ac1cd83152d9dd3f1f252607b402f5b8c3b610726270f944bdbd215c63973c4482ded4db216ba03d99698e3240686f
SSDEEP

3072:cI6CqRCxffkClZ8Cqn7LQlRw6x+Y3CxT2DtK5jdUQY5:cIDff9D8CcXYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3128 1676 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3128	1676	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4444 wrote to memory of 1676	4444	rundll32.exe	rundll32.exe
PID 4444 wrote to memory of 1676	4444	rundll32.exe	rundll32.exe
PID 4444 wrote to memory of 1676	4444	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_7babd9277f60db75e161e4125248e4ba_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_7babd9277f60db75e161e4125248e4ba_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 632
3⤵
- Program crash
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1676 -ip 1676
1⤵
PID:1800