Analysis
-
max time kernel
129s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:02
Behavioral task
behavioral1
Sample
0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll
Resource
win10v2004-20240508-en
General
-
Target
0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll
-
Size
205KB
-
MD5
929493e4c03e878e46ca88c8a564073c
-
SHA1
0c2712831160ac410150c084a3e8eabedb31c3d0
-
SHA256
0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7
-
SHA512
3dff476f00fe1a0833b34c8404bc98e979cca9656ca4a0f4b953cb31bcaf709dab6b8521d31c102c892b45bab8c1cb59f838f922c82e9bbf9fecb865a97ff9dd
-
SSDEEP
3072://QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUAEJ5J9://MEfuN0t8C5oFsoeRM3o0j6v
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4216 4644 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3472 wrote to memory of 4644 3472 rundll32.exe rundll32.exe PID 3472 wrote to memory of 4644 3472 rundll32.exe rundll32.exe PID 3472 wrote to memory of 4644 3472 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4644 -ip 46441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4644-0-0x0000000000590000-0x00000000005CE000-memory.dmpFilesize
248KB