1124858dc8b05581facdd79894b008ecd1d07f010122e0ef41e155530f6cdd8f

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2023, 16:01

Target
2023-08-26_ab3ca4e83b39ef632f7dcdf7de41bc28_cobalt-strike_cobaltstrike_JC.dll
Size 207KB
Sample230929-tghpsaeb92
SHA256 1124858dc8b05581facdd79894b008ecd1d07f010122e0ef41e155530f6cdd8f
MD5 ab3ca4e83b39ef632f7dcdf7de41bc28
SHA1 405ecac8a3e16b76fe9e8073629095642cfa4d62
SHA512 0c7f7e72355c75e2310e3d655a4371f9f924dded118ea397fa35f37010921d97723af94746304ee037f9a2c910d1ff905f341f9adb7e6d556ea9114cc6323bab
SSDEEP 3072:KlC60GeD6N9Za5Yp6zPC952DmKX0tDV2/jqBkLcP6j5U15c:KNxfaWUzPWEKKX0pURLcyjz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 4104	944	rundll32.exe	84
PID 944 wrote to memory of 4104	944	rundll32.exe	84
PID 944 wrote to memory of 4104	944	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_ab3ca4e83b39ef632f7dcdf7de41bc28_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_ab3ca4e83b39ef632f7dcdf7de41bc28_cobalt-strike_cobaltstrike_JC.dll,#1
  2⤵
  PID:4104