68af72da2bae05be511bfec642a1b9e5bad68798d941ad5c87b1784af10c9de9

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 09:46

Target

2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe
Size

789KB
MD5

30e64dbe83876f52c20480e98b0b17e3
SHA1

1afde9edae3cff6530c47ab0b611e5d791b332d3
SHA256

68af72da2bae05be511bfec642a1b9e5bad68798d941ad5c87b1784af10c9de9
SHA512

2b4dbe5563c8907201a1026099662efe3981452fe4da1f8657c362ea8a4fbff32328ab89bb7e4cabb44237802d81972e7e9661e2115a501acdaadccdd7f5217d
SSDEEP

12288:xJj5t6MewMDaAwBV73ikZfNQua7kAF4UWj8RSB31424vTti192MXXuh+V88k0vbp:3SMvikhN9314liqMXehI8jJZ2vK6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3104 3316 WerFault.exe 2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe

pid	pid_target	process	target process
3104	3316	WerFault.exe	2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_30e64dbe83876f52c20480e98b0b17e3_avoslocker_cobalt-strike.exe"
1⤵
PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 292
  2⤵
  - Program crash
  PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3316 -ip 3316
1⤵
PID:5036