3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac

Analysis

max time kernel
144s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 15:12

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

b26b412d9f1050ad53f663c972fdcd9f
SHA1

7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256

70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512

ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
SSDEEP

48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2000	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2000	4168	rundll32.exe	93
PID 4168 wrote to memory of 2000	4168	rundll32.exe	93
PID 4168 wrote to memory of 2000	4168	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 600
    3⤵
    - Program crash
    PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2000 -ip 2000
1⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2900