335019a2df320f1d67cffdf222c4fa40ba7c471ddeaa88d0a17f59b3552b15c2

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 21:14

Target

2023-08-25_a6b76a29733906ed85602be63fd6f21a_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

a6b76a29733906ed85602be63fd6f21a
SHA1

3e5dc82a18e92f4f96d6db2cd143bef232ab11ea
SHA256

335019a2df320f1d67cffdf222c4fa40ba7c471ddeaa88d0a17f59b3552b15c2
SHA512

c41c1114e4f519e9dc70b128669028e40d4b4b8f5fa661dc0ea9dc94e67525b48e9669792b99799b6bfa65cbe69a620066d43ef5ee86a6422a3197ec8e6dcde3
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUKY5rS:LIDff9D8C6XYRw6MT2DEjB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 1100 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1896	1100	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1100	2068	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1896	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1896	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1896	1100	rundll32.exe	WerFault.exe
PID 1100 wrote to memory of 1896	1100	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-25_a6b76a29733906ed85602be63fd6f21a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-25_a6b76a29733906ed85602be63fd6f21a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 232
3⤵
- Program crash
PID:1896