cobaltstrike | 0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 14:31

Target

0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll
Size

205KB
MD5

929493e4c03e878e46ca88c8a564073c
SHA1

0c2712831160ac410150c084a3e8eabedb31c3d0
SHA256

0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7
SHA512

3dff476f00fe1a0833b34c8404bc98e979cca9656ca4a0f4b953cb31bcaf709dab6b8521d31c102c892b45bab8c1cb59f838f922c82e9bbf9fecb865a97ff9dd
SSDEEP

3072://QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUAEJ5J9://MEfuN0t8C5oFsoeRM3o0j6v

Score

10^/10

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1012 3488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1012	3488	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1916 wrote to memory of 3488	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 3488	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 3488	1916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0336bd9e7fa6b45e28f1855bebe40a937c4b51c77b9e2ff7e93ff298881ea1a7.dll,#1
2⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 632
3⤵
- Program crash
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:4020

memory/3488-0-0x0000000000B90000-0x0000000000BCE000-memory.dmp

Filesize
248KB

Download