7b6f807e19ddcbe41c5edc783d33632fda942b7a7d4a0b42a0c38b89ac984f45

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 17:57

Target

2023-08-27_3ef47ce4886dccf76abf0cf07c9c44bf_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

3ef47ce4886dccf76abf0cf07c9c44bf
SHA1

7c52b514da77fc5d7d53b38d8afc49386cbd0057
SHA256

7b6f807e19ddcbe41c5edc783d33632fda942b7a7d4a0b42a0c38b89ac984f45
SHA512

616a2c4fdce29c19616167ce716703480309172b047a1bf4a90e136cc7bad586f9dbd6070d2e184325e599e2a7837d19bb87093f3a88c91684de218c2d609994
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUGi5C6:n3vyJNRkZHBvZp0qoOCu2pkojnZHj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	1600	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 2988 wrote to memory of 1600	2988	rundll32.exe	28
PID 1600 wrote to memory of 2248	1600	rundll32.exe	29
PID 1600 wrote to memory of 2248	1600	rundll32.exe	29
PID 1600 wrote to memory of 2248	1600	rundll32.exe	29
PID 1600 wrote to memory of 2248	1600	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-27_3ef47ce4886dccf76abf0cf07c9c44bf_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-27_3ef47ce4886dccf76abf0cf07c9c44bf_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 232
    3⤵
    - Program crash
    PID:2248