9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:43

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

ebd0da54db9f12ffd15206cc24355793
SHA1

910be3bebdde55eb1ce05915a79f01ebdc622786
SHA256

4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6
SHA512

cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d
SSDEEP

48:im1wsjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0J9of5d2D:F18Bl91Z7/ycNSCwV8TLZR0ed2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2012 2984 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2012	2984	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2984	2932	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 2012	2984	rundll32.exe	WerFault.exe
PID 2984 wrote to memory of 2012	2984	rundll32.exe	WerFault.exe
PID 2984 wrote to memory of 2012	2984	rundll32.exe	WerFault.exe
PID 2984 wrote to memory of 2012	2984	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 224
3⤵
- Program crash
PID:2012