69a11a096a22fd51630e3f3a93b5a1fbb9c9f86ec8a968ea31457ddecf843f10

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 12:34

Target

2023-08-26_3387813562a3ecb15c9695d7d63838ea_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

3387813562a3ecb15c9695d7d63838ea
SHA1

41f8179b785fb78e0900efeefdbae9aaa97d4e58
SHA256

69a11a096a22fd51630e3f3a93b5a1fbb9c9f86ec8a968ea31457ddecf843f10
SHA512

224378fc62c9b585de9355a23864de3bb8a1beb84ad6648bb05acf98890987dd089e237b801d51793aa798b13c4124157f1b4d41bb8109e3fa3ba54c470c883f
SSDEEP

3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZUKGf5zw6E:AHEbJAZwBqplpAX/LmjbubE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	4344	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4192	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 4344	3748	rundll32.exe	81
PID 3748 wrote to memory of 4344	3748	rundll32.exe	81
PID 3748 wrote to memory of 4344	3748	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_3387813562a3ecb15c9695d7d63838ea_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_3387813562a3ecb15c9695d7d63838ea_cobalt-strike_cobaltstrike_JC.dll,#1
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 680
    3⤵
    - Program crash
    PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4344 -ip 4344
1⤵
PID:3800

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4192

memory/4192-0-0x00000152F5540000-0x00000152F5550000-memory.dmp

Filesize
64KB

Download
memory/4192-16-0x00000152F5640000-0x00000152F5650000-memory.dmp

Filesize
64KB

Download
memory/4192-32-0x00000152FD940000-0x00000152FD941000-memory.dmp

Filesize
4KB

Download
memory/4192-34-0x00000152FD970000-0x00000152FD971000-memory.dmp

Filesize
4KB

Download
memory/4192-35-0x00000152FD970000-0x00000152FD971000-memory.dmp

Filesize
4KB

Download
memory/4192-36-0x00000152FDA80000-0x00000152FDA81000-memory.dmp

Filesize
4KB

Download