26999eb068fa757e3e97667dbee8cc5c8e46e965ad681218476b804df0c0d774

Analysis

max time kernel
177s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 13:31

Target

2023-08-26_812845d50ba675a77a47baafb72b1587_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

812845d50ba675a77a47baafb72b1587
SHA1

83a14a2d3a98bd540934ac0c3500a52f9173103f
SHA256

26999eb068fa757e3e97667dbee8cc5c8e46e965ad681218476b804df0c0d774
SHA512

3dd49a3330e77d1c948166f1f914968e720679547726f7c846803db383558779251ca5c7b1750c17953662637bd4b4461ef7dbff277c66a53b762a4fbd67775a
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUP56OV3:n3vyJNRkZHBvZp0qoOCu2pkojnZHjyV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	3672	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3672	4080	rundll32.exe	83
PID 4080 wrote to memory of 3672	4080	rundll32.exe	83
PID 4080 wrote to memory of 3672	4080	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_812845d50ba675a77a47baafb72b1587_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_812845d50ba675a77a47baafb72b1587_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 632
    3⤵
    - Program crash
    PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3672 -ip 3672
1⤵
PID:1472