8a91a5d6b395eb58411fc11ef64d73721f51bd80d8da193910a690f3e791a16b

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2023 19:46

Target

2023-08-23_bc79d08dd924f6385a7d0f5fe2143a84_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

bc79d08dd924f6385a7d0f5fe2143a84
SHA1

2702bb507ddddd2499e7b3c8032e3d0251a146af
SHA256

8a91a5d6b395eb58411fc11ef64d73721f51bd80d8da193910a690f3e791a16b
SHA512

be08d6c022c7df07eb072803722099c6e909251e9fd391cd9f12e68c1a52cbfeebb21d4d5e8e844feebf7de66a64f3b5b3e5f4390a8c941932e4a13c730a0550
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdUPx589:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4920 2780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4920	2780	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1856 wrote to memory of 2780	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2780	1856	rundll32.exe	rundll32.exe
PID 1856 wrote to memory of 2780	1856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_bc79d08dd924f6385a7d0f5fe2143a84_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-23_bc79d08dd924f6385a7d0f5fe2143a84_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 632
3⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2780 -ip 2780
1⤵
PID:764