24b0e84318448157475a455d4aa17550d7323396a4ea0402b55d4a031592c6a4

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 20:20

Target

NEAS.2023-09-07_085c9bacbfba75b9f9c450580bdef26f_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

085c9bacbfba75b9f9c450580bdef26f
SHA1

fd78bf282245aeef32c1e865ff03e3af3078dd25
SHA256

24b0e84318448157475a455d4aa17550d7323396a4ea0402b55d4a031592c6a4
SHA512

84104620fce773fb617957c563004279bf818014f4be2f19e4fdc815f23b9adaa8e7c33ef0075f7d820cec1714b932c6983e1080d244fd54dac7779f069e8a4d
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUHiY5BW1:cIDff9D8C6XYRw6MT2DEjy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1556 1956 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1556	1956	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 1956	1608	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1556	1956	rundll32.exe	WerFault.exe
PID 1956 wrote to memory of 1556	1956	rundll32.exe	WerFault.exe
PID 1956 wrote to memory of 1556	1956	rundll32.exe	WerFault.exe
PID 1956 wrote to memory of 1556	1956	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_085c9bacbfba75b9f9c450580bdef26f_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_085c9bacbfba75b9f9c450580bdef26f_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 232
3⤵
- Program crash
PID:1556