0d1408d64dd7b802608a667e3c0f279886432e8ebc092984d1b80558fc625596

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 16:12

Target

2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe
Size

583KB
MD5

392e80effcad0bec49da1cae59dfa0df
SHA1

4bab8ca0b7ed256402c36a266c6eaf1a6f703b87
SHA256

0d1408d64dd7b802608a667e3c0f279886432e8ebc092984d1b80558fc625596
SHA512

da2fe392cfb350cf5854b23d6187f31401fccec1e3fdf7aa94e34abbb7ef3f000f82e59978dbe317a75eb11cc02c9cc66b3e96330a9659c652004bd85fd0fafd
SSDEEP

12288:7RaXb/FXVHMBhx/D8WlhVe2f1yt0uWWgaRjUut26sFhmGacnBV/e:7IXbzHMBhxbhrVeOlfQof/e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 2088 WerFault.exe 2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe

pid	pid_target	process	target process
1744	2088	WerFault.exe	2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe

description	pid	process	target process
PID 2088 wrote to memory of 1744	2088	2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe
PID 2088 wrote to memory of 1744	2088	2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe
PID 2088 wrote to memory of 1744	2088	2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe
PID 2088 wrote to memory of 1744	2088	2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 184
2⤵
- Program crash
PID:1744