b9e14fe9e4731bc7fa792de27223d77af21e44f8f6a183111a58500d1a258dc5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 12:53

Target

2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe
Size

485KB
MD5

d0f08a7b5810f5b48fc13260541852f6
SHA1

4321ea7fe0fb86ab8d775514df9d60611cade1cb
SHA256

b9e14fe9e4731bc7fa792de27223d77af21e44f8f6a183111a58500d1a258dc5
SHA512

7af7a582b4ef525914be913b209009631d62850d597340584c12c353f6e5290ded423bd8134ed29b653c1a7898e5315b8881abc417cf591c2cc4345e4b36f2bd
SSDEEP

6144:C7WQ0j4ltziolIGlnE2dFD5rlBu0R+J5JlLgPYfq8ZF02IlLZDp0nXe:qi4lZiox5fu0R+J5JlLgPbDp0n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	1960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2320	1960	2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe	28
PID 1960 wrote to memory of 2320	1960	2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe	28
PID 1960 wrote to memory of 2320	1960	2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe	28
PID 1960 wrote to memory of 2320	1960	2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_d0f08a7b5810f5b48fc13260541852f6_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 156
  2⤵
  - Program crash
  PID:2320

memory/1960-0-0x0000000000850000-0x00000000008D3000-memory.dmp

Filesize
524KB

Download