3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 15:12

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

b26b412d9f1050ad53f663c972fdcd9f
SHA1

7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256

70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512

ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
SSDEEP

48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 4124 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4560	4124	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4888 wrote to memory of 4124	4888	rundll32.exe	rundll32.exe
PID 4888 wrote to memory of 4124	4888	rundll32.exe	rundll32.exe
PID 4888 wrote to memory of 4124	4888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:4124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 600
    3⤵
    - Program crash
    PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4124 -ip 4124
1⤵
PID:1804