Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-09-2023 14:19
Behavioral task
behavioral1
Sample
2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll
Resource
win10v2004-20230831-en
General
-
Target
2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll
-
Size
204KB
-
MD5
626838ff091bf5eb58a599232eba79e8
-
SHA1
70c5b9bd655c16f8ca150f5a2867fd43eaa559af
-
SHA256
f2b2a4c04ad59f7995c71f019820e2312b04e1fe5e2b22b50b7cd6aa60c1e459
-
SHA512
fedc45ba9c005cd4c932c91bd4e46f58c2afc30713bca06b328959ff02fe3b5436137ab8ffaafe9802595358295a220edbd5a65ef318ff34c31d0543d66a7dba
-
SSDEEP
3072:ydFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQU4a5D4:8RYkcrY4MCIt07iPlvU0j8Z
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2476 3052 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 2980 wrote to memory of 3052 2980 rundll32.exe rundll32.exe PID 3052 wrote to memory of 2476 3052 rundll32.exe WerFault.exe PID 3052 wrote to memory of 2476 3052 rundll32.exe WerFault.exe PID 3052 wrote to memory of 2476 3052 rundll32.exe WerFault.exe PID 3052 wrote to memory of 2476 3052 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 2323⤵
- Program crash