423f75097f80b27ae154abad360321285aa0735a4f34e8a015c6859b4e42b268

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 16:05

Target

2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe
Size

583KB
MD5

052038f3c3c00966525133da727287e9
SHA1

7cc10fe11987cdc301107a78a0c2d476e4b9ac37
SHA256

423f75097f80b27ae154abad360321285aa0735a4f34e8a015c6859b4e42b268
SHA512

cc9e80ecd2ca0642743cfa9b1791c80a6b42fb3e50b589168b4004db80b37695ba90a8c93277ab96e859879c8abe2fdfa6919b2f0a7ba03ed11a9251ab7287aa
SSDEEP

12288:7RaXb/FXVHMBhx/D8WlhVe2f1yt0uWWgaRjUut26sFh2GacnB1/e:7IXbzHMBhxbhrVeOlfMor/e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2228 2864 WerFault.exe 2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe

pid	pid_target	process	target process
2228	2864	WerFault.exe	2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe

description	pid	process	target process
PID 2864 wrote to memory of 2228	2864	2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe
PID 2864 wrote to memory of 2228	2864	2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe
PID 2864 wrote to memory of 2228	2864	2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe
PID 2864 wrote to memory of 2228	2864	2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_052038f3c3c00966525133da727287e9_avoslocker_cobalt-strike_raccoonstealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 184
2⤵
- Program crash
PID:2228