cae0382efb23e2846657ed7b1917fcda8355e2cda912aff125f6102ca4e6f14c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-09-2023 15:25

Target

2023-08-24_8101c680913ca5698c4754204cc4d3d2_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

8101c680913ca5698c4754204cc4d3d2
SHA1

999c842fb03ec34a6f4f066ef880bcd3a74c1336
SHA256

cae0382efb23e2846657ed7b1917fcda8355e2cda912aff125f6102ca4e6f14c
SHA512

9b4a977c550e38372ab2083162a7aa043651d472c3a2ecd91cf0733258be3961b6c2aebb2ec1acfaa9a83d2decb2b3432f53da8b399ea1918010abcf2652af43
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdU/5g4:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1544 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1684	1544	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1544	2232	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1684	1544	rundll32.exe	WerFault.exe
PID 1544 wrote to memory of 1684	1544	rundll32.exe	WerFault.exe
PID 1544 wrote to memory of 1684	1544	rundll32.exe	WerFault.exe
PID 1544 wrote to memory of 1684	1544	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_8101c680913ca5698c4754204cc4d3d2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_8101c680913ca5698c4754204cc4d3d2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 232
3⤵
- Program crash
PID:1684