Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2023 14:19
Behavioral task
behavioral1
Sample
2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll
Resource
win10v2004-20230831-en
General
-
Target
2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll
-
Size
204KB
-
MD5
626838ff091bf5eb58a599232eba79e8
-
SHA1
70c5b9bd655c16f8ca150f5a2867fd43eaa559af
-
SHA256
f2b2a4c04ad59f7995c71f019820e2312b04e1fe5e2b22b50b7cd6aa60c1e459
-
SHA512
fedc45ba9c005cd4c932c91bd4e46f58c2afc30713bca06b328959ff02fe3b5436137ab8ffaafe9802595358295a220edbd5a65ef318ff34c31d0543d66a7dba
-
SSDEEP
3072:ydFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQU4a5D4:8RYkcrY4MCIt07iPlvU0j8Z
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3756 2976 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 5016 wrote to memory of 2976 5016 rundll32.exe rundll32.exe PID 5016 wrote to memory of 2976 5016 rundll32.exe rundll32.exe PID 5016 wrote to memory of 2976 5016 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_626838ff091bf5eb58a599232eba79e8_cobalt-strike_cobaltstrike_JC.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 6323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2976 -ip 29761⤵