147e182026e208d0200b4d58472859666bdac7264487bd5ee58822805590895e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:54

Target

$PLUGINSDIR/kcaomoc.dll
Size

161KB
MD5

14034a1337df8a2f06625046305d115e
SHA1

9ad015babecda4058e57ec14523e50876e421ff5
SHA256

7d8c368a43a48db3907cd13ba82aabd6bc1fd8f857d693f0147cd3fd68333778
SHA512

f801980272dd2c5fdc5d45351ce29e3af14d292227308cbb8033a6cb7bfc8db60a1676fe09c17cb172396db1dae0c5e5d043fd0861dd36ff383b2ea1cc00f880
SSDEEP

1536:GdLDJ+sSDf5obf2Nsu08hIT2QinOmx8If0vlM188XSvGLp0bLTbE2jgY+PCcows0:GdBZS4QOBK88CvGLKEIz+QVdQYMZccH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 844 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1660	844	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 844	2208	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe
PID 844 wrote to memory of 1660	844	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kcaomoc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kcaomoc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 220
3⤵
- Program crash
PID:1660