2521c36107a687d21bc17d6603ef51de9daa4e212c3d749b57683ba804e3534d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23-09-2023 11:40

Target

2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

29351f1e6a63bd430094ce1156a72c03
SHA1

fc5aac3031eb9169b903059e347fa58e7c976183
SHA256

2521c36107a687d21bc17d6603ef51de9daa4e212c3d749b57683ba804e3534d
SHA512

d2fea0afb7a2df96b6d7eaf0e6cfe9e0e589b628277ee8a908159c0c330277fee9ebec8f7c0c96932ceb08468276697ff40b5cee3183702000838d75fc6c9331
SSDEEP

3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUWk5Iw6E:AHEbJAZwBqplpAX/Lmj3jbE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1720	1968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 2160 wrote to memory of 1968	2160	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1720	1968	rundll32.exe	WerFault.exe
PID 1968 wrote to memory of 1720	1968	rundll32.exe	WerFault.exe
PID 1968 wrote to memory of 1720	1968	rundll32.exe	WerFault.exe
PID 1968 wrote to memory of 1720	1968	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_29351f1e6a63bd430094ce1156a72c03_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 244
3⤵
- Program crash
PID:1720