4d234c2492c20f209c48c5d1314eb9218cd65efd674b28e2f93d8bd7adde35f4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 15:09

Target

2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe
Size

11.1MB
MD5

c64c3bd487b6d1d34a7cf2ac077ba19c
SHA1

73481bf10b2658305ca5263788b44f85f5843371
SHA256

4d234c2492c20f209c48c5d1314eb9218cd65efd674b28e2f93d8bd7adde35f4
SHA512

f267ac6b60df583447dd4a798695ce4eccd87f3d3a88c101c988de2c1df691e55ec6b9188d4cbd63f4b0894f1f430bdb23b082e05040ebd7bbadff05160084a2
SSDEEP

98304:HNty57QQPujFFL7PBVOoAABT12NoF2GOZcr/ktiDJWt5dZ/Zvh:HNO2/ZVOoAABOowGwXwVWt5dt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3936	2884	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	93
PID 2884 wrote to memory of 3936	2884	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	93
PID 2884 wrote to memory of 3936	2884	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- \??\c:\windows\system32\svchost.exe
  c:\windows\system32\svchost.exe
  2⤵
  PID:3936