9868e15ce5dee4ac08bbb900151fae026a036f5f80c9b6bc5f8746b64002aec5 | Triage

Resubmissions

14/02/2024, 10:18

240214-mcaeaafg4y 7

14/02/2024, 10:16

240214-masg3sgg75 7

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 10:16

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

f3a5b5ee30a039a4c136f7718b768c54
SHA1

8030564028871328a67fd7184c6f6476fa5d3cab
SHA256

2a5d0cf98084a3e9cd6d0007fcdd39810164ec82e74c513d51ab51bd85866b1a
SHA512

861635ba6e139516cb9316723bdf8b5022178f660b2234bd48212a1992391f727d33bf8f6c88976b5c78979916b879d2d614b99205ee41cc33c5046f17558b01
SSDEEP

48:q9PmFK19eP3PBHWxJWL44A3kFQsy80WTCdHJmLHRMXb5jE6E9ivnuB:MHqBHWJWL4uF5CWTCdHJgCnu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	4192	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4192	3308	rundll32.exe	84
PID 3308 wrote to memory of 4192	3308	rundll32.exe	84
PID 3308 wrote to memory of 4192	3308	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 600
    3⤵
    - Program crash
    PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4192 -ip 4192
1⤵
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads