3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 15:12

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

b26b412d9f1050ad53f663c972fdcd9f
SHA1

7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256

70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512

ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
SSDEEP

48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2824 2772 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2824	2772	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2772	1772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 2824	2772	rundll32.exe	WerFault.exe
PID 2772 wrote to memory of 2824	2772	rundll32.exe	WerFault.exe
PID 2772 wrote to memory of 2824	2772	rundll32.exe	WerFault.exe
PID 2772 wrote to memory of 2824	2772	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 228
3⤵
- Program crash
PID:2824