3005892c47a0e4b8aaf3d0ad9a680287fec02657c422d3da3c5d8267c1586e7d

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 16:25

Target

NEAS.2023-09-06_0e91a99013857bf15c19566502015408_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

234KB
MD5

0e91a99013857bf15c19566502015408
SHA1

bcd20cae6c86d1edf47d3a285b802943bf7069c4
SHA256

3005892c47a0e4b8aaf3d0ad9a680287fec02657c422d3da3c5d8267c1586e7d
SHA512

39d536bb9e978660b0b7a3b5a83a2c0f1f03dc98be13fdaafd5c98dc6afbda18f7f503d8b084b1ab503f26388d254fc3bd95b454c635821a2a9b8d9eae4cc043
SSDEEP

3072:n3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUBO5woS:n3vyJNRkZHBvZp0qoOCu2pkojnZHj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3724	464	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 464	852	rundll32.exe	86
PID 852 wrote to memory of 464	852	rundll32.exe	86
PID 852 wrote to memory of 464	852	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_0e91a99013857bf15c19566502015408_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_0e91a99013857bf15c19566502015408_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 632
    3⤵
    - Program crash
    PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 464 -ip 464
1⤵
PID:932