68848492f6cf49ea8639440aae60b606d364cd00158da763aedfdade101978b0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:34

Target

2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe
Size

838KB
MD5

1c3eaac718c34a1fff1ee5b1fb27e442
SHA1

774ea5af0d6fdf3994c06fe300cdb122219dd369
SHA256

68848492f6cf49ea8639440aae60b606d364cd00158da763aedfdade101978b0
SHA512

0f3ae339dd69e60504d0bc804306a3e5952c690cd0cadd11ccd6b0928e86a621315ce983cf98d447895e23ccc56e3738f5b5d98c30e3c72236641716487815ab
SSDEEP

12288:HJj5t6MewMDaAwBV73ikZfnQua7kAF4UWj8RSB31424vTti192MXXuh+V88k0vbB:pSMvikhn9314liqMXehI8jJZRuKoeu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2164 2132 WerFault.exe 2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe

pid	pid_target	process	target process
2164	2132	WerFault.exe	2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe

description	pid	process	target process
PID 2132 wrote to memory of 2164	2132	2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2132 wrote to memory of 2164	2132	2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2132 wrote to memory of 2164	2132	2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2132 wrote to memory of 2164	2132	2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 92
2⤵
- Program crash
PID:2164