6cf13e6543d1c332b866d6b4eb7aad2b8742d79e6a5933cd4819602e651a7556

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 07:59

Target

NEAS.2023-09-08_d91c37d153342b991f00d65cb58466f4_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

206KB
MD5

d91c37d153342b991f00d65cb58466f4
SHA1

408f7b91193ccaf55aa85fd6d526a5ed82e9d65a
SHA256

6cf13e6543d1c332b866d6b4eb7aad2b8742d79e6a5933cd4819602e651a7556
SHA512

3811ee22ba26ed6ee4d1a38d16775811168c089c9711b436e394ba71403a925008a35eaad43703ef60d45722808c3e30df69285951744ec148dbe1c1ce3a9119
SSDEEP

3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUS5Mlsj:ZwXupN1x8CgBbRLDTuLj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2512	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2512 wrote to memory of 2528	2512	rundll32.exe	29
PID 2512 wrote to memory of 2528	2512	rundll32.exe	29
PID 2512 wrote to memory of 2528	2512	rundll32.exe	29
PID 2512 wrote to memory of 2528	2512	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_d91c37d153342b991f00d65cb58466f4_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_d91c37d153342b991f00d65cb58466f4_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 232
    3⤵
    - Program crash
    PID:2528