325cd8cd74165c89739dc34ef141db4dcbbe849fbf63b952bd13f080e8506f8f

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:55

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

c9ac0758ce8c10793d39655064c653cb
SHA1

8ba1f9dfcc671b5102f5940da67570c28252bc71
SHA256

161d69c50e5c50d853fda129b6f6f6bc241214b87d13a33bf93543e7e6886119
SHA512

54a8c2ded9a42de867c8a89a11701bcdb5d51aea168c4f3ffe8991859cf26f15d478b6111c85732c1059edbfd9408e42ca830706347a8ac87c5064e47d823349
SSDEEP

48:SnKQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJpABofgMGKO:Qz+MM4eqmvz0JScx56mpwzAhWjGV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2292 wrote to memory of 2200	2292	rundll32.exe	28
PID 2200 wrote to memory of 2312	2200	rundll32.exe	29
PID 2200 wrote to memory of 2312	2200	rundll32.exe	29
PID 2200 wrote to memory of 2312	2200	rundll32.exe	29
PID 2200 wrote to memory of 2312	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 228
    3⤵
    - Program crash
    PID:2312