9370991678c4aeb9d1c410eeba2a9c1c7655564137f54ed1505f7ff90ad46907

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 12:43

Target

2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe
Size

485KB
MD5

951425435b79b097d35da610a88626e0
SHA1

c69c409333365fa2e5636974e513fb5978b62c1a
SHA256

9370991678c4aeb9d1c410eeba2a9c1c7655564137f54ed1505f7ff90ad46907
SHA512

806921c7369df5765c12cfba4a48519bbdc10591f2ac70c703d3564cc1e1fb7eb096c64c59b4309b3a1a034dcf41a4a964eb22b8c522627fd37e416f02202115
SSDEEP

6144:C7WQ0j4ltziolIGlnE2dFDnrlBu0R+J5JlLgPYfq8ZF02IlLZDe0nXe:qi4lZioxnfu0R+J5JlLgPbDe0n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2220	2248	2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe	28
PID 2248 wrote to memory of 2220	2248	2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe	28
PID 2248 wrote to memory of 2220	2248	2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe	28
PID 2248 wrote to memory of 2220	2248	2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-27_951425435b79b097d35da610a88626e0_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 156
  2⤵
  - Program crash
  PID:2220

memory/2248-0-0x0000000000350000-0x00000000003D3000-memory.dmp

Filesize
524KB

Download