ebaa065d271337817943a89790442b108e0bdcf93b36627be1758b44b070feb9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 11:06

Target

2023-08-26_8ce38429baddbb4f7fae2b08c290ff7a_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

8ce38429baddbb4f7fae2b08c290ff7a
SHA1

d7b9b7e12d777f7db8e24f1d3e7005c17a9cce3f
SHA256

ebaa065d271337817943a89790442b108e0bdcf93b36627be1758b44b070feb9
SHA512

9cdb91e032b9f9c48138d260d41d7c2953f95d258cbc4c2726740771aa0eafd83e0f7ce0004e6d1e898897928ce063694d01fd7c9d85e89bbcb321fa9f4f9d94
SSDEEP

3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZURTswk5Qw6E:AHEbJAZwBqplpAX/Lmj4swbbE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1980 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3004	1980	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1980	2124	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 3004	1980	rundll32.exe	WerFault.exe
PID 1980 wrote to memory of 3004	1980	rundll32.exe	WerFault.exe
PID 1980 wrote to memory of 3004	1980	rundll32.exe	WerFault.exe
PID 1980 wrote to memory of 3004	1980	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_8ce38429baddbb4f7fae2b08c290ff7a_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_8ce38429baddbb4f7fae2b08c290ff7a_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 244
3⤵
- Program crash
PID:3004