335019a2df320f1d67cffdf222c4fa40ba7c471ddeaa88d0a17f59b3552b15c2

Analysis

max time kernel
153s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 21:14

Target

2023-08-25_a6b76a29733906ed85602be63fd6f21a_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

a6b76a29733906ed85602be63fd6f21a
SHA1

3e5dc82a18e92f4f96d6db2cd143bef232ab11ea
SHA256

335019a2df320f1d67cffdf222c4fa40ba7c471ddeaa88d0a17f59b3552b15c2
SHA512

c41c1114e4f519e9dc70b128669028e40d4b4b8f5fa661dc0ea9dc94e67525b48e9669792b99799b6bfa65cbe69a620066d43ef5ee86a6422a3197ec8e6dcde3
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUKY5rS:LIDff9D8C6XYRw6MT2DEjB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2608 1220 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2608	1220	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4556 wrote to memory of 1220	4556	rundll32.exe	rundll32.exe
PID 4556 wrote to memory of 1220	4556	rundll32.exe	rundll32.exe
PID 4556 wrote to memory of 1220	4556	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-25_a6b76a29733906ed85602be63fd6f21a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023-08-25_a6b76a29733906ed85602be63fd6f21a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 632
3⤵
- Program crash
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1220 -ip 1220
1⤵
PID:4924