24b0e84318448157475a455d4aa17550d7323396a4ea0402b55d4a031592c6a4

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 20:20

Target

NEAS.2023-09-07_085c9bacbfba75b9f9c450580bdef26f_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

085c9bacbfba75b9f9c450580bdef26f
SHA1

fd78bf282245aeef32c1e865ff03e3af3078dd25
SHA256

24b0e84318448157475a455d4aa17550d7323396a4ea0402b55d4a031592c6a4
SHA512

84104620fce773fb617957c563004279bf818014f4be2f19e4fdc815f23b9adaa8e7c33ef0075f7d820cec1714b932c6983e1080d244fd54dac7779f069e8a4d
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUHiY5BW1:cIDff9D8C6XYRw6MT2DEjy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4136 2896 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4136	2896	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2232 wrote to memory of 2896	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2896	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2896	2232	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_085c9bacbfba75b9f9c450580bdef26f_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_085c9bacbfba75b9f9c450580bdef26f_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 640
3⤵
- Program crash
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2896 -ip 2896
1⤵
PID:1264