68af72da2bae05be511bfec642a1b9e5bad68798d941ad5c87b1784af10c9de9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 09:46

Target

2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe
Size

789KB
MD5

30e64dbe83876f52c20480e98b0b17e3
SHA1

1afde9edae3cff6530c47ab0b611e5d791b332d3
SHA256

68af72da2bae05be511bfec642a1b9e5bad68798d941ad5c87b1784af10c9de9
SHA512

2b4dbe5563c8907201a1026099662efe3981452fe4da1f8657c362ea8a4fbff32328ab89bb7e4cabb44237802d81972e7e9661e2115a501acdaadccdd7f5217d
SSDEEP

12288:xJj5t6MewMDaAwBV73ikZfNQua7kAF4UWj8RSB31424vTti192MXXuh+V88k0vbp:3SMvikhN9314liqMXehI8jJZ2vK6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2024 2724 WerFault.exe 2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe

pid	pid_target	process	target process
2024	2724	WerFault.exe	2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe

description	pid	process	target process
PID 2724 wrote to memory of 2024	2724	2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2724 wrote to memory of 2024	2724	2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2724 wrote to memory of 2024	2724	2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe	WerFault.exe
PID 2724 wrote to memory of 2024	2724	2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 92
  2⤵
  - Program crash
  PID:2024