1630e885d4a9ba87cc53c88f109832e2521b4603650199dbd2e47e8249de4e46

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:39

Target

$PLUGINSDIR/okm.dll
Size

121KB
MD5

aabfcf8ab7a7e3ed904e3a9120307a97
SHA1

2267c746bae40071ad79590418f32903f9b249de
SHA256

6dc0194bfee51a0510e55c4dbe427694ab0da03f2c5c6f19537c835cb4a0d496
SHA512

78d5843f748af65ea4afe2eab5184bfff53e1bba232326b45ab701efa59aab8c81c52cceb4be2498ace8edf51302844a3a66a1e97018082192c0cb528a276a1d
SSDEEP

1536:5b2MhKdCoC8ES6HWRL4bG1c5oVQnIWSOGf/ohGEyknRBEela6kCalj:5tIdC+yaytnINfwnyoEejkCalj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1448 2312 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1448	2312	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2980 wrote to memory of 2312	2980	rundll32.exe	rundll32.exe
PID 2312 wrote to memory of 1448	2312	rundll32.exe	WerFault.exe
PID 2312 wrote to memory of 1448	2312	rundll32.exe	WerFault.exe
PID 2312 wrote to memory of 1448	2312	rundll32.exe	WerFault.exe
PID 2312 wrote to memory of 1448	2312	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\okm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\okm.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 224
3⤵
- Program crash
PID:1448