2a001b7da023f1ac595f235a72fec29869433dfb8cc48268484ac9c578eeb049

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:49

Target

2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe
Size

788KB
MD5

75eec566a80213c9106ae16d4e58d56e
SHA1

1e35c2087354507fb2e70183b4f689ba9e5c204d
SHA256

2a001b7da023f1ac595f235a72fec29869433dfb8cc48268484ac9c578eeb049
SHA512

564857ab910fc8c00bd42ec834e0f6c2216bf345dd94c58be3fff8f08c0caea9042c91571d98c25b41da63ae404c25867887d90ee2056ecb152677eb5bafeefb
SSDEEP

12288:hJj5t6MewMDaAwBV73ikZfzQua7kAF4UWj8RSB31424vTti192MXXuh+V88k0vbo:HSMvikhz9314liqMXehI8jJZavKv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3180 428 WerFault.exe 2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe

pid	pid_target	process	target process
3180	428	WerFault.exe	2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_75eec566a80213c9106ae16d4e58d56e_avoslocker_cobalt-strike.exe"
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 292
2⤵
- Program crash
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 428 -ip 428
1⤵
PID:4080