f81955d71f3b6bda792886a815e36fee54ab72b51e45c02533f3f7f1c9e9c7a0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:35

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

b26b412d9f1050ad53f663c972fdcd9f
SHA1

7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256

70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512

ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
SSDEEP

48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2680 1984 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2680	1984	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1984	1992	rundll32.exe	rundll32.exe
PID 1984 wrote to memory of 2680	1984	rundll32.exe	WerFault.exe
PID 1984 wrote to memory of 2680	1984	rundll32.exe	WerFault.exe
PID 1984 wrote to memory of 2680	1984	rundll32.exe	WerFault.exe
PID 1984 wrote to memory of 2680	1984	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 224
    3⤵
    - Program crash
    PID:2680