06dadd6e272350aead7c342bdbe5e06987b9fda584a199082dec69c4d4b4e480

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:49

Target

2023-08-26_b4e62e6fd6152ef0c38bb682dbfe96fa_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

b4e62e6fd6152ef0c38bb682dbfe96fa
SHA1

fca949d2c42fa43b72f266554f8169ef128b7a35
SHA256

06dadd6e272350aead7c342bdbe5e06987b9fda584a199082dec69c4d4b4e480
SHA512

315b677c949def06940e122cfed0aa3fd3a5edb232c2b56499e25ae880b8a3e8bd0d023b696b35c0abad4084d4a14c6e03d5445fe07a301fa3e9d65fb0c6e171
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUEJY5K:LIDff9D8C6XYRw6MT2DEjp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 2492 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2488	2492	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 2492	2124	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	WerFault.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	WerFault.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	WerFault.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_b4e62e6fd6152ef0c38bb682dbfe96fa_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_b4e62e6fd6152ef0c38bb682dbfe96fa_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 232
3⤵
- Program crash
PID:2488