585a233ae88cd32506e0634d4d82a06a0a669fe9d45c664d4fa811f8e962c19d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 09:36

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

ebd0da54db9f12ffd15206cc24355793
SHA1

910be3bebdde55eb1ce05915a79f01ebdc622786
SHA256

4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6
SHA512

cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d
SSDEEP

48:im1wsjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0J9of5d2D:F18Bl91Z7/ycNSCwV8TLZR0ed2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	1432	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1284 wrote to memory of 1432	1284	rundll32.exe	28
PID 1432 wrote to memory of 2668	1432	rundll32.exe	29
PID 1432 wrote to memory of 2668	1432	rundll32.exe	29
PID 1432 wrote to memory of 2668	1432	rundll32.exe	29
PID 1432 wrote to memory of 2668	1432	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 228
    3⤵
    - Program crash
    PID:2668