4055d85bef953e2dbc21856bd0f0969ff1cad9cbd400972e3bb09be7d54dc4b6

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-10-2023 21:24

Target

NEAS.2023-09-08_ade0652516f23a17a8e0864e98a3be49_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

ade0652516f23a17a8e0864e98a3be49
SHA1

e133a950b4dc0dcb4a2c342bacdfdfbd963b2301
SHA256

4055d85bef953e2dbc21856bd0f0969ff1cad9cbd400972e3bb09be7d54dc4b6
SHA512

4a4fbf21abb24b726874fa7f57dc8b7bb06ab3ba087ca7e174d0ede517fd96f19d0001a81f4d7b93c279ced88143afd4f66bbff40b69860f1c4654e5a0aa1374
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdURY51W:cIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2600 2604 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2600	2604	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2604	2696	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 2600	2604	rundll32.exe	WerFault.exe
PID 2604 wrote to memory of 2600	2604	rundll32.exe	WerFault.exe
PID 2604 wrote to memory of 2600	2604	rundll32.exe	WerFault.exe
PID 2604 wrote to memory of 2600	2604	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ade0652516f23a17a8e0864e98a3be49_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ade0652516f23a17a8e0864e98a3be49_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 232
3⤵
- Program crash
PID:2600