047395bab7cccf7f5179169e35c5da5bbc4625ec084508f966b94314eb22a6bb

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2024 13:05

Target

2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe
Size

3.8MB
MD5

9c1ccf6b5b942e0ffdb3f3f689359b8c
SHA1

5a3523f6e6fa11c6f4bf3cf9a3057d881bd1e7c5
SHA256

047395bab7cccf7f5179169e35c5da5bbc4625ec084508f966b94314eb22a6bb
SHA512

6ec2d0840b496aade1a4eceb663d7273f3b92bdd937f6429e6c6cf356efa510789bf1c7d470cf1b96640d7e0cf728a43db3cd56f95adcc853b9a7b84ba6a6049
SSDEEP

49152:5/Y+Lx24MRKwSKh3GZULeOSeBzPGYwsGrZbfcrxrJ4FbFHNd1e6N:lTJ2VJcbfd1e6N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe

description	pid	process	target process
PID 1528 wrote to memory of 4072	1528	2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe	jsc.exe
PID 1528 wrote to memory of 4072	1528	2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe	jsc.exe
PID 1528 wrote to memory of 4072	1528	2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-18_9c1ccf6b5b942e0ffdb3f3f689359b8c_cobalt-strike_megazord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
PID:4072