ebaa065d271337817943a89790442b108e0bdcf93b36627be1758b44b070feb9

Analysis

max time kernel
81s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 11:06

Target
2023-08-26_8ce38429baddbb4f7fae2b08c290ff7a_cobalt-strike_cobaltstrike_JC.dll
Size 208KB
Sample231011-m7rl2scd76
SHA256 ebaa065d271337817943a89790442b108e0bdcf93b36627be1758b44b070feb9
MD5 8ce38429baddbb4f7fae2b08c290ff7a
SHA1 d7b9b7e12d777f7db8e24f1d3e7005c17a9cce3f
SHA512 9cdb91e032b9f9c48138d260d41d7c2953f95d258cbc4c2726740771aa0eafd83e0f7ce0004e6d1e898897928ce063694d01fd7c9d85e89bbcb321fa9f4f9d94
SSDEEP 3072:z+FcIvEbJvYdGVWwk4Kj6olpR2B5f4dS/L4jjZURTswk5Qw6E:AHEbJAZwBqplpAX/Lmj4swbbE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	1540	WerFault.exe	71

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1540	804	rundll32.exe	71
PID 804 wrote to memory of 1540	804	rundll32.exe	71
PID 804 wrote to memory of 1540	804	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_8ce38429baddbb4f7fae2b08c290ff7a_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_8ce38429baddbb4f7fae2b08c290ff7a_cobalt-strike_cobaltstrike_JC.dll,#1
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 680
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1540 -ip 1540
1⤵
PID:2292