c5eb40772b10a97309d705b2a08eada313685bc1643cfa337baf8878c71771e3

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 05:51

Target

2023-08-26_ad50deb516ba935f8ec6a63646579a4b_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

ad50deb516ba935f8ec6a63646579a4b
SHA1

fa4b830e64d96f39ab650e09ecf397ad8c9756ca
SHA256

c5eb40772b10a97309d705b2a08eada313685bc1643cfa337baf8878c71771e3
SHA512

0873687100150a661135bbbc71ae3838e24284b406f99fdc8095a88fa2792faa737c21dde804fea4a81d9f0b7f007e61daa3c9972edb693ced34553d8a4c36c1
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUXY50:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3896 4176 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3896	4176	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 460 wrote to memory of 4176	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 4176	460	rundll32.exe	rundll32.exe
PID 460 wrote to memory of 4176	460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_ad50deb516ba935f8ec6a63646579a4b_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_ad50deb516ba935f8ec6a63646579a4b_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 632
3⤵
- Program crash
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4176 -ip 4176
1⤵
PID:3196