4055d85bef953e2dbc21856bd0f0969ff1cad9cbd400972e3bb09be7d54dc4b6

Analysis

max time kernel
134s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2023 21:24

Target

NEAS.2023-09-08_ade0652516f23a17a8e0864e98a3be49_cobalt-strike_cobaltstrike_JC.dll
Size

208KB
MD5

ade0652516f23a17a8e0864e98a3be49
SHA1

e133a950b4dc0dcb4a2c342bacdfdfbd963b2301
SHA256

4055d85bef953e2dbc21856bd0f0969ff1cad9cbd400972e3bb09be7d54dc4b6
SHA512

4a4fbf21abb24b726874fa7f57dc8b7bb06ab3ba087ca7e174d0ede517fd96f19d0001a81f4d7b93c279ced88143afd4f66bbff40b69860f1c4654e5a0aa1374
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdURY51W:cIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3512 4492 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3512	4492	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4652 wrote to memory of 4492	4652	rundll32.exe	rundll32.exe
PID 4652 wrote to memory of 4492	4652	rundll32.exe	rundll32.exe
PID 4652 wrote to memory of 4492	4652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ade0652516f23a17a8e0864e98a3be49_cobalt-strike_cobaltstrike_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ade0652516f23a17a8e0864e98a3be49_cobalt-strike_cobaltstrike_JC.dll,#1
2⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 632
3⤵
- Program crash
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4492 -ip 4492
1⤵
PID:3044