0fb88011c5fabfea2136ae840afa2128c6c943956ba823a580ac88373c109952

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:41

Target

2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe
Size

485KB
MD5

4f7c9e472266d6a1d30fb3c5ce04e763
SHA1

7e9de46fbe61e607feedbeaa943defa073a55883
SHA256

0fb88011c5fabfea2136ae840afa2128c6c943956ba823a580ac88373c109952
SHA512

1f0f80783869d19eb449a5b61e4c68aed23283fbf3256585c162755ccab859344a2550f52ed0ab1169655f9fa06c37ee505fc29708caa1679149f65a3ac7c789
SSDEEP

6144:C7WQ0j4ltziolIGlnE2dFD8rlBu0R+J5JlLgPYfq8ZF02IlLZDz0nXe:qi4lZiox8fu0R+J5JlLgPbDz0n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	1776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2592	1776	2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe	28
PID 1776 wrote to memory of 2592	1776	2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe	28
PID 1776 wrote to memory of 2592	1776	2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe	28
PID 1776 wrote to memory of 2592	1776	2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_4f7c9e472266d6a1d30fb3c5ce04e763_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 156
  2⤵
  - Program crash
  PID:2592

memory/1776-0-0x00000000012F0000-0x0000000001373000-memory.dmp

Filesize
524KB

Download