0d60601a1157cff3eba748a058ac48b94f25989aa30aba124be9c45877a7e034

Analysis

max time kernel
195s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
24/02/2024, 18:29

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

356977adc8dc0d8d17d7f8a2b789004f
SHA1

c4bf52c11425e6c061d4e36d97c5a2d7a4360191
SHA256

8091a25eb5307bc1837e1e59a5d7dc36faa5190114202a835c415cc6df069dee
SHA512

4d6ec569ea719845b31f98713e67e27ab6d6a4037b74a121ab768197a6ee6c4c5581348c9dfa7f228c489ef09e54bead9ed422f39eef74742fffebc8f6658de5
SSDEEP

48:qVXAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptqGUaEJkof5d2:I11GED5ZTvycNSmwVsTJuft+/d2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4640	3416	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3416	4176	rundll32.exe	72
PID 4176 wrote to memory of 3416	4176	rundll32.exe	72
PID 4176 wrote to memory of 3416	4176	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 616
    3⤵
    - Program crash
    PID:4640