8a91a5d6b395eb58411fc11ef64d73721f51bd80d8da193910a690f3e791a16b

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 19:46

Target

2023-08-23_bc79d08dd924f6385a7d0f5fe2143a84_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

bc79d08dd924f6385a7d0f5fe2143a84
SHA1

2702bb507ddddd2499e7b3c8032e3d0251a146af
SHA256

8a91a5d6b395eb58411fc11ef64d73721f51bd80d8da193910a690f3e791a16b
SHA512

be08d6c022c7df07eb072803722099c6e909251e9fd391cd9f12e68c1a52cbfeebb21d4d5e8e844feebf7de66a64f3b5b3e5f4390a8c941932e4a13c730a0550
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdUPx589:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 2160 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2192	2160	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 2160	532	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 2192	2160	rundll32.exe	WerFault.exe
PID 2160 wrote to memory of 2192	2160	rundll32.exe	WerFault.exe
PID 2160 wrote to memory of 2192	2160	rundll32.exe	WerFault.exe
PID 2160 wrote to memory of 2192	2160	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_bc79d08dd924f6385a7d0f5fe2143a84_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_bc79d08dd924f6385a7d0f5fe2143a84_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 232
3⤵
- Program crash
PID:2192