2a001b7da023f1ac595f235a72fec29869433dfb8cc48268484ac9c578eeb049

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:49

Target

2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe
Size

788KB
MD5

75eec566a80213c9106ae16d4e58d56e
SHA1

1e35c2087354507fb2e70183b4f689ba9e5c204d
SHA256

2a001b7da023f1ac595f235a72fec29869433dfb8cc48268484ac9c578eeb049
SHA512

564857ab910fc8c00bd42ec834e0f6c2216bf345dd94c58be3fff8f08c0caea9042c91571d98c25b41da63ae404c25867887d90ee2056ecb152677eb5bafeefb
SSDEEP

12288:hJj5t6MewMDaAwBV73ikZfzQua7kAF4UWj8RSB31424vTti192MXXuh+V88k0vbo:HSMvikhz9314liqMXehI8jJZavKv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2184 2728 WerFault.exe 2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe

pid	pid_target	process	target process
2184	2728	WerFault.exe	2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe

description	pid	process	target process
PID 2728 wrote to memory of 2184	2728	2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2728 wrote to memory of 2184	2728	2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2728 wrote to memory of 2184	2728	2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2728 wrote to memory of 2184	2728	2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 92
2⤵
- Program crash
PID:2184