c25cd6bb506f002f65949babed6f069714481bbb50fca128beb7cd643e20c651

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 21:43

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

2c08daee8c2b1bb8a2f6e5ba27022699
SHA1

0103d528067531830053cbd7a0f6fe9ef4c8ee81
SHA256

9abc4122846abda7a3233e3ea8b363046e2a57ca625bb6239c4ddd55b8584352
SHA512

44f57802c208bd9559956393df3f3f4839703401bb21a9a35caf336f28da37bc45ac76071e304563708d3e470cb704222d478e441111762378cd07da5e6040b4
SSDEEP

48:Sn8Q/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJ/ABofgMGKO:yz+MM4eqmvz0JScx56mpwzAhWVGV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5060	2456	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2456	5020	rundll32.exe	83
PID 5020 wrote to memory of 2456	5020	rundll32.exe	83
PID 5020 wrote to memory of 2456	5020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 600
    3⤵
    - Program crash
    PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2456 -ip 2456
1⤵
PID:1116