5336f0b78ccd4a2f4d0e3c9e31ca7aa5df748aa84a3496c660e9d6ee8fbe7317

Analysis

max time kernel
130s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 19:26

Target

NEAS.2023-09-08_9929067b40365d4925c3059094b47f52_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

9929067b40365d4925c3059094b47f52
SHA1

20694574f70f82bc98468126955f53ee9387b915
SHA256

5336f0b78ccd4a2f4d0e3c9e31ca7aa5df748aa84a3496c660e9d6ee8fbe7317
SHA512

1101dc5a97519bec032b31ddd8246320cdd915e60b2ced35c557c44655ebae66ebf3edcf1de03266c45d938b19801b9e3c7d94d3524862ccb1d77effcfb5dc97
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUg5j3:n3vyJNRkZHBvZp0qoOCu2pkojnZHj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	208	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 208	3264	rundll32.exe	82
PID 3264 wrote to memory of 208	3264	rundll32.exe	82
PID 3264 wrote to memory of 208	3264	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_9929067b40365d4925c3059094b47f52_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_9929067b40365d4925c3059094b47f52_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 632
    3⤵
    - Program crash
    PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 208 -ip 208
1⤵
PID:3384