147e182026e208d0200b4d58472859666bdac7264487bd5ee58822805590895e

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:54

Target

$PLUGINSDIR/kcaomoc.dll
Size

161KB
MD5

14034a1337df8a2f06625046305d115e
SHA1

9ad015babecda4058e57ec14523e50876e421ff5
SHA256

7d8c368a43a48db3907cd13ba82aabd6bc1fd8f857d693f0147cd3fd68333778
SHA512

f801980272dd2c5fdc5d45351ce29e3af14d292227308cbb8033a6cb7bfc8db60a1676fe09c17cb172396db1dae0c5e5d043fd0861dd36ff383b2ea1cc00f880
SSDEEP

1536:GdLDJ+sSDf5obf2Nsu08hIT2QinOmx8If0vlM188XSvGLp0bLTbE2jgY+PCcows0:GdBZS4QOBK88CvGLKEIz+QVdQYMZccH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 5064 WerFault.exe rundll32.exe

pid	pid_target	process	target process
888	5064	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2980 wrote to memory of 5064	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 5064	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 5064	2980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kcaomoc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kcaomoc.dll,#1
2⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 600
3⤵
- Program crash
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5064 -ip 5064
1⤵
PID:1128