88cfede42188d89c02902431f688fd90b5947eb2155f6b40a1f75f3cfc010e2b | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 02:05

Sharing

Report Analysis Logs

General

Target

cobasslx64.exe
Size

3.8MB
MD5

e59fb03e91165f508223a27dfdfff0b0
SHA1

46a8c17f3155cfbf5fb1c871954c9697322aeb28
SHA256

3c6390e8c2eb4264e5a56a777110022ca533c3fa42ec0619151de6e2f9929a0a
SHA512

14120923cd2104dd354c80f24de32c11a45100373c6e810b45c37554340fada3b0cddb7edb8823e544535c0eafd926dbdb9897e08a089b187959543cd9d1fcc3
SSDEEP

49152:rkfRcO0CvVN8otW/bFw6vPnLv6TUJPsE1:YaWVSotWTp3LxyO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1812	3068	cobasslx64.exe	30
PID 3068 wrote to memory of 1812	3068	cobasslx64.exe	30
PID 3068 wrote to memory of 1812	3068	cobasslx64.exe	30

C:\Users\Admin\AppData\Local\Temp\cobasslx64.exe
"C:\Users\Admin\AppData\Local\Temp\cobasslx64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 104
  2⤵
  PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-1-0x00000000001D0000-0x000000000021E000-memory.dmp

Filesize
312KB

Download
memory/3068-0-0x00000000001D0000-0x000000000021E000-memory.dmp

Filesize
312KB

Download