0de54ccd8146146f7b7b5e92885b919779e2e923b2a12319f258d2e32d7777cd | Triage

Analysis

max time kernel
136s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 07:42

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

50016010fb0d8db2bc4cd258ceb43be5
SHA1

44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA256

32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512

ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP

48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

876 4932 WerFault.exe rundll32.exe
4528 4932 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 700 wrote to memory of 4932	700	rundll32.exe	rundll32.exe
PID 700 wrote to memory of 4932	700	rundll32.exe	rundll32.exe
PID 700 wrote to memory of 4932	700	rundll32.exe	rundll32.exe
PID 4932 wrote to memory of 876	4932	rundll32.exe	WerFault.exe
PID 4932 wrote to memory of 876	4932	rundll32.exe	WerFault.exe
PID 4932 wrote to memory of 876	4932	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 600
3⤵
- Program crash
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 600
3⤵
- Program crash
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4932 -ip 4932
1⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads