cae0382efb23e2846657ed7b1917fcda8355e2cda912aff125f6102ca4e6f14c

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2023 15:25

Target

2023-08-24_8101c680913ca5698c4754204cc4d3d2_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

203KB
MD5

8101c680913ca5698c4754204cc4d3d2
SHA1

999c842fb03ec34a6f4f066ef880bcd3a74c1336
SHA256

cae0382efb23e2846657ed7b1917fcda8355e2cda912aff125f6102ca4e6f14c
SHA512

9b4a977c550e38372ab2083162a7aa043651d472c3a2ecd91cf0733258be3961b6c2aebb2ec1acfaa9a83d2decb2b3432f53da8b399ea1918010abcf2652af43
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdU/5g4:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 4696 WerFault.exe rundll32.exe

pid	pid_target	process	target process
860	4696	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 4696	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 4696	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 4696	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_8101c680913ca5698c4754204cc4d3d2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-24_8101c680913ca5698c4754204cc4d3d2_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 640
3⤵
- Program crash
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4696 -ip 4696
1⤵
PID:3616