0d1408d64dd7b802608a667e3c0f279886432e8ebc092984d1b80558fc625596

Analysis

max time kernel
133s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:12

Target

2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe
Size

583KB
MD5

392e80effcad0bec49da1cae59dfa0df
SHA1

4bab8ca0b7ed256402c36a266c6eaf1a6f703b87
SHA256

0d1408d64dd7b802608a667e3c0f279886432e8ebc092984d1b80558fc625596
SHA512

da2fe392cfb350cf5854b23d6187f31401fccec1e3fdf7aa94e34abbb7ef3f000f82e59978dbe317a75eb11cc02c9cc66b3e96330a9659c652004bd85fd0fafd
SSDEEP

12288:7RaXb/FXVHMBhx/D8WlhVe2f1yt0uWWgaRjUut26sFhmGacnBV/e:7IXbzHMBhxbhrVeOlfQof/e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2524 4128 WerFault.exe 2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe

pid	pid_target	process	target process
2524	4128	WerFault.exe	2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_392e80effcad0bec49da1cae59dfa0df_avoslocker_cobalt-strike_raccoonstealer.exe"
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 520
2⤵
- Program crash
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
1⤵
PID:404