06dadd6e272350aead7c342bdbe5e06987b9fda584a199082dec69c4d4b4e480

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 05:49

Target

2023-08-26_b4e62e6fd6152ef0c38bb682dbfe96fa_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

b4e62e6fd6152ef0c38bb682dbfe96fa
SHA1

fca949d2c42fa43b72f266554f8169ef128b7a35
SHA256

06dadd6e272350aead7c342bdbe5e06987b9fda584a199082dec69c4d4b4e480
SHA512

315b677c949def06940e122cfed0aa3fd3a5edb232c2b56499e25ae880b8a3e8bd0d023b696b35c0abad4084d4a14c6e03d5445fe07a301fa3e9d65fb0c6e171
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUEJY5K:LIDff9D8C6XYRw6MT2DEjp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3348 4484 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3348	4484	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4816 wrote to memory of 4484	4816	rundll32.exe	rundll32.exe
PID 4816 wrote to memory of 4484	4816	rundll32.exe	rundll32.exe
PID 4816 wrote to memory of 4484	4816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_b4e62e6fd6152ef0c38bb682dbfe96fa_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_b4e62e6fd6152ef0c38bb682dbfe96fa_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 632
3⤵
- Program crash
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 4484
1⤵
PID:1744