8df05e255ce1317db4abb9d84c00917f23d3d0ef9ca0bde0cd05e1d7d50efed6 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 06:06

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/GokKae.dll
Size

157KB
MD5

4683ef5c8d0635d32de57422d9481faf
SHA1

8e76c9f2df4acd2345fea0f81c7982fa55617eda
SHA256

115e9443280a097a35e343075518c7303810b147c121881ac8255aa40d62ca24
SHA512

30293873fef4ccf6b8924ba3dcb5d48b5a6fb369e8e5feceece86a91a6c5adfe299757d8f7e7c84e435f9735bc0a6e659dced2b7a719a20a437150d9b6182716
SSDEEP

3072:llWT9JBzf3es45kmEvM8zP1GRXIPiyWStwu9zIvQwc5WCwYUs:llWT1Z45kmx8zPExsxjKCDUs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	2100	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2100	2112	rundll32.exe	83
PID 2112 wrote to memory of 2100	2112	rundll32.exe	83
PID 2112 wrote to memory of 2100	2112	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GokKae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GokKae.dll,#1
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 640
    3⤵
    - Program crash
    PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2100 -ip 2100
1⤵
PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads