325cd8cd74165c89739dc34ef141db4dcbbe849fbf63b952bd13f080e8506f8f

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 13:55

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

c9ac0758ce8c10793d39655064c653cb
SHA1

8ba1f9dfcc671b5102f5940da67570c28252bc71
SHA256

161d69c50e5c50d853fda129b6f6f6bc241214b87d13a33bf93543e7e6886119
SHA512

54a8c2ded9a42de867c8a89a11701bcdb5d51aea168c4f3ffe8991859cf26f15d478b6111c85732c1059edbfd9408e42ca830706347a8ac87c5064e47d823349
SSDEEP

48:SnKQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJpABofgMGKO:Qz+MM4eqmvz0JScx56mpwzAhWjGV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	4816	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 4816	1460	rundll32.exe	86
PID 1460 wrote to memory of 4816	1460	rundll32.exe	86
PID 1460 wrote to memory of 4816	1460	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 600
    3⤵
    - Program crash
    PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4816 -ip 4816
1⤵
PID:1864