9945afe9883a2b84c0284033dab4e3cb2ea2cdf43e94624dd646eb685e84c876

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:10 UTC

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

ab1db56369412fe8476fefffd11e4cc0
SHA1

daad036a83b2ee2fa86d840a34a341100552e723
SHA256

6f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
SHA512

8d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
SSDEEP

48:S46+/zTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mxofjLl:z5uPbOBtWZBV8jAWiAJCdv2CmAL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1800	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1972 wrote to memory of 1800	1972	rundll32.exe	28
PID 1800 wrote to memory of 1724	1800	rundll32.exe	29
PID 1800 wrote to memory of 1724	1800	rundll32.exe	29
PID 1800 wrote to memory of 1724	1800	rundll32.exe	29
PID 1800 wrote to memory of 1724	1800	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 220
    3⤵
    - Program crash
    PID:1724