6170520c214de6d208bd57f5bd3cf860403bd36b994bdb3841f8633143e9ecd2

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 18:04

Target

NEAS.2023-09-08_cb1027b42acff35113f28f35ec66a20a_cobalt-strike_cobaltstrike_meterpreter_JC.dll
Size

208KB
MD5

cb1027b42acff35113f28f35ec66a20a
SHA1

b12cc3446390835e8cd8e7ae105c11fa0bf41534
SHA256

6170520c214de6d208bd57f5bd3cf860403bd36b994bdb3841f8633143e9ecd2
SHA512

98192d9345586bf321d5a5208e1f03bf7360c4d2df05ba89a59769b017e721d18c254639d04be1a4409e520bca3b5ef8294c02e910b38e0af33ed63da5b59cb0
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU5Y5c:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2436 2116 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2436	2116	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2116	2040	rundll32.exe	rundll32.exe
PID 2116 wrote to memory of 2436	2116	rundll32.exe	WerFault.exe
PID 2116 wrote to memory of 2436	2116	rundll32.exe	WerFault.exe
PID 2116 wrote to memory of 2436	2116	rundll32.exe	WerFault.exe
PID 2116 wrote to memory of 2436	2116	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_cb1027b42acff35113f28f35ec66a20a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_cb1027b42acff35113f28f35ec66a20a_cobalt-strike_cobaltstrike_meterpreter_JC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 232
3⤵
- Program crash
PID:2436