26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9

Analysis

max time kernel
127s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 01:14

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

ebd0da54db9f12ffd15206cc24355793
SHA1

910be3bebdde55eb1ce05915a79f01ebdc622786
SHA256

4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6
SHA512

cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d
SSDEEP

48:im1wsjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0J9of5d2D:F18Bl91Z7/ycNSCwV8TLZR0ed2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4416	3444	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3444	5076	rundll32.exe	87
PID 5076 wrote to memory of 3444	5076	rundll32.exe	87
PID 5076 wrote to memory of 3444	5076	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 600
    3⤵
    - Program crash
    PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3444 -ip 3444
1⤵
PID:1640