8cdd3fc132cf7aa41c4b182dd34078c2ad55181b890261a32f392f95ab88e518

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 00:44

Target

2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe
Size

148KB
MD5

005fadba1ad93acb33eccddc6567e38e
SHA1

75c83b6129bf8b316aae795903c13ee64ec96da1
SHA256

8cdd3fc132cf7aa41c4b182dd34078c2ad55181b890261a32f392f95ab88e518
SHA512

7085c659cf8a358f0e5b9544222f7e404eefad6bf1a1234af861ab57b1e9acce2a6b000ba80957b61348ee025dfa23638047900f476933104d5bebd7f14b9bc4
SSDEEP

3072:Fgf3/Nukj5dlEBMQ5GrIeErme5xv+2/5z1HL1y8bL:FgfckLlECyYErBt+kGE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	2348	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2992	2348	2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe	29
PID 2348 wrote to memory of 2992	2348	2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe	29
PID 2348 wrote to memory of 2992	2348	2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe	29
PID 2348 wrote to memory of 2992	2348	2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-26_005fadba1ad93acb33eccddc6567e38e_cobalt-strike_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 732
  2⤵
  - Program crash
  PID:2992