1630e885d4a9ba87cc53c88f109832e2521b4603650199dbd2e47e8249de4e46

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:39

Target

$PLUGINSDIR/okm.dll
Size

121KB
MD5

aabfcf8ab7a7e3ed904e3a9120307a97
SHA1

2267c746bae40071ad79590418f32903f9b249de
SHA256

6dc0194bfee51a0510e55c4dbe427694ab0da03f2c5c6f19537c835cb4a0d496
SHA512

78d5843f748af65ea4afe2eab5184bfff53e1bba232326b45ab701efa59aab8c81c52cceb4be2498ace8edf51302844a3a66a1e97018082192c0cb528a276a1d
SSDEEP

1536:5b2MhKdCoC8ES6HWRL4bG1c5oVQnIWSOGf/ohGEyknRBEela6kCalj:5tIdC+yaytnINfwnyoEejkCalj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3988 3076 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3988	3076	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2968 wrote to memory of 3076	2968	rundll32.exe	rundll32.exe
PID 2968 wrote to memory of 3076	2968	rundll32.exe	rundll32.exe
PID 2968 wrote to memory of 3076	2968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\okm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\okm.dll,#1
2⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 600
3⤵
- Program crash
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3076 -ip 3076
1⤵
PID:2868