da3e3f3bbeb83e1293b8c45b93a3b0542af2099629a09b6a0c1a03fec21a2441

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-09-2023 13:48

Target

2023-08-24_0478400b10853ff03c3ec8e37bae3ab9_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

0478400b10853ff03c3ec8e37bae3ab9
SHA1

99736f89183db1996bdd8673054012d6c93173a2
SHA256

da3e3f3bbeb83e1293b8c45b93a3b0542af2099629a09b6a0c1a03fec21a2441
SHA512

242716ec274e294f1cd4ef5fc922aa286d5c5e8c450d0db952eab2e5252a91d26217fd7e25498a5fd480683ea6471fa44bf2e5037caba82da3141341f2380c35
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUxY5M:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2068 1724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2068	1724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1724	2208	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 2068	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2068	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2068	1724	rundll32.exe	WerFault.exe
PID 1724 wrote to memory of 2068	1724	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_0478400b10853ff03c3ec8e37bae3ab9_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_0478400b10853ff03c3ec8e37bae3ab9_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 232
3⤵
- Program crash
PID:2068