4f30d15663071b058bd1e4156ebadb80e9c88d33e8671626bc215d358e794bc8

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 11:26

Target

2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe
Size

485KB
MD5

cb911e6870a7585e3f6b8a3675e0198e
SHA1

f31e9c0a4232d66e156a8070fb12a59ae512c2a1
SHA256

4f30d15663071b058bd1e4156ebadb80e9c88d33e8671626bc215d358e794bc8
SHA512

73387d3d723f967a52b4c054a4f85e8a0a028461421c3e086545b2ea0fc9d9a51db9409f2161f5b3ff9d97f9383db3a91bfbddb315549b0f9a6d94646f527d7c
SSDEEP

6144:C7WQ0j4ltziolIGlnE2dFD3rlBu0R+J5JlLgPYfq8ZF02IlLZDL0nXe:qi4lZiox3fu0R+J5JlLgPbDL0n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1952	2860	2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe	28
PID 2860 wrote to memory of 1952	2860	2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe	28
PID 2860 wrote to memory of 1952	2860	2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe	28
PID 2860 wrote to memory of 1952	2860	2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_cb911e6870a7585e3f6b8a3675e0198e_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 156
  2⤵
  - Program crash
  PID:1952

memory/2860-0-0x0000000000330000-0x00000000003B3000-memory.dmp

Filesize
524KB

Download