69a11a096a22fd51630e3f3a93b5a1fbb9c9f86ec8a968ea31457ddecf843f10

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 12:34

Target

2023-08-26_3387813562a3ecb15c9695d7d63838ea_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

3387813562a3ecb15c9695d7d63838ea
SHA1

41f8179b785fb78e0900efeefdbae9aaa97d4e58
SHA256

69a11a096a22fd51630e3f3a93b5a1fbb9c9f86ec8a968ea31457ddecf843f10
SHA512

224378fc62c9b585de9355a23864de3bb8a1beb84ad6648bb05acf98890987dd089e237b801d51793aa798b13c4124157f1b4d41bb8109e3fa3ba54c470c883f
SSDEEP

3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUKGf5zw6E:AHEbJAZwBqplpAX/LmjbubE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2272	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2324 wrote to memory of 2272	2324	rundll32.exe	28
PID 2272 wrote to memory of 2284	2272	rundll32.exe	29
PID 2272 wrote to memory of 2284	2272	rundll32.exe	29
PID 2272 wrote to memory of 2284	2272	rundll32.exe	29
PID 2272 wrote to memory of 2284	2272	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_3387813562a3ecb15c9695d7d63838ea_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_3387813562a3ecb15c9695d7d63838ea_cobalt-strike_cobaltstrike_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 244
    3⤵
    - Program crash
    PID:2284