79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21

Analysis

max time kernel
292s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 22:20

Target

$PLUGINSDIR/LangDLL.dll
Size

8KB
MD5

2ac83ff9f2eb44ee250e2007423f7784
SHA1

d7fe9e3db03a24b603a4a61ec287fa2c1073d364
SHA256

1f9ef3943d58dd80a774a5a81578b48bc90f494025e71f6e40ef7def3a06ddf2
SHA512

0aebd903e1a77bec0fac7a1f2ad88e57b9bcb07b351907164f4e674150f1c02807b7667b6fc04fd1e5b27607bbfa87cc179b03f10762b4bb781a3dfbed6c97bf
SSDEEP

192:TopZK6yypD9pg5Z8YkvQhRibNU/2/ojr:8vK685Z8YkvKibN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	1724	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1756 wrote to memory of 1724	1756	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	29
PID 1724 wrote to memory of 2380	1724	rundll32.exe	29
PID 1724 wrote to memory of 2380	1724	rundll32.exe	29
PID 1724 wrote to memory of 2380	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 220
    3⤵
    - Program crash
    PID:2380

memory/1724-0-0x00000000749A0000-0x00000000749AA000-memory.dmp

Filesize
40KB

Download