491a6af81acbfab366c9352a40a513f5f2f6e095f1b397d180b629e6dadbbe1a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 05:59

Target

2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe
Size

107KB
MD5

ae45c6cebda8480eb1386e8a1d716740
SHA1

9027f9d584254f94969815396aa18561470be5ae
SHA256

491a6af81acbfab366c9352a40a513f5f2f6e095f1b397d180b629e6dadbbe1a
SHA512

7698cbff56803f902fa3bf0ed406a28dc434f134aad161224ac1da98d2309422a2b57cdc21dc921453841de488fa2411f8f60e5fe7c6440f7b164669fadae00c
SSDEEP

3072:IO4PuGUKJwRdtct2HhEBy852+wnioW+QBCovx:IJU3RdtcteEBR0l1ovx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2948	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3048	2948	2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe	28
PID 2948 wrote to memory of 3048	2948	2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe	28
PID 2948 wrote to memory of 3048	2948	2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe	28
PID 2948 wrote to memory of 3048	2948	2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_ae45c6cebda8480eb1386e8a1d716740_clop_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 148
  2⤵
  - Program crash
  PID:3048