da536d32f348c44bb7e7e707064bda49ce7f10fd050430958c5b21364a3c3388

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:57

Target

2023-08-26_53a9c4c4f4dde61e3f63dc48f967aa2f_cobalt-strike_cobaltstrike_JC.dll
Size

234KB
MD5

53a9c4c4f4dde61e3f63dc48f967aa2f
SHA1

3929836921d3a2d2891f95d36ecb4d4de96da664
SHA256

da536d32f348c44bb7e7e707064bda49ce7f10fd050430958c5b21364a3c3388
SHA512

fd7e5bdc2c95eff054989786a16548d3b8be2417ec6167ba2460fb9466b3a85462ba9336e7c016e7564fa2d4901bb8c3060a3de991fff24212edf6308e8596f1
SSDEEP

3072:+3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUxL5gWD:+3vyJNRkZHBvZp0qoOCu2pkojnZHj0R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	1216	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 2356 wrote to memory of 1216	2356	rundll32.exe	28
PID 1216 wrote to memory of 1388	1216	rundll32.exe	29
PID 1216 wrote to memory of 1388	1216	rundll32.exe	29
PID 1216 wrote to memory of 1388	1216	rundll32.exe	29
PID 1216 wrote to memory of 1388	1216	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_53a9c4c4f4dde61e3f63dc48f967aa2f_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-26_53a9c4c4f4dde61e3f63dc48f967aa2f_cobalt-strike_cobaltstrike_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 232
    3⤵
    - Program crash
    PID:1388