cobaltstrike | 0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 14:31

Target

0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll
Size

205KB
MD5

929493e4c03e878e46ca88c8a564073c
SHA1

0c2712831160ac410150c084a3e8eabedb31c3d0
SHA256

0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7
SHA512

3dff476f00fe1a0833b34c8404bc98e979cca9656ca4a0f4b953cb31bcaf709dab6b8521d31c102c892b45bab8c1cb59f838f922c82e9bbf9fecb865a97ff9dd
SSDEEP

3072://QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUAEJ5J9://MEfuN0t8C5oFsoeRM3o0j6v

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2492 2956 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2492	2956	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2492	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2492	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2492	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2492	2956	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 228
    3⤵
    - Program crash
    PID:2492

memory/2956-0-0x00000000001C0000-0x00000000001FE000-memory.dmp

Filesize
248KB

Download