8df05e255ce1317db4abb9d84c00917f23d3d0ef9ca0bde0cd05e1d7d50efed6

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 06:06

Target

$PLUGINSDIR/GokKae.dll
Size

157KB
MD5

4683ef5c8d0635d32de57422d9481faf
SHA1

8e76c9f2df4acd2345fea0f81c7982fa55617eda
SHA256

115e9443280a097a35e343075518c7303810b147c121881ac8255aa40d62ca24
SHA512

30293873fef4ccf6b8924ba3dcb5d48b5a6fb369e8e5feceece86a91a6c5adfe299757d8f7e7c84e435f9735bc0a6e659dced2b7a719a20a437150d9b6182716
SSDEEP

3072:llWT9JBzf3es45kmEvM8zP1GRXIPiyWStwu9zIvQwc5WCwYUs:llWT1Z45kmx8zPExsxjKCDUs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2244	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2192 wrote to memory of 2244	2192	rundll32.exe	28
PID 2244 wrote to memory of 2368	2244	rundll32.exe	29
PID 2244 wrote to memory of 2368	2244	rundll32.exe	29
PID 2244 wrote to memory of 2368	2244	rundll32.exe	29
PID 2244 wrote to memory of 2368	2244	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GokKae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GokKae.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 236
    3⤵
    - Program crash
    PID:2368