fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
86s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:08

Target
$PLUGINSDIR/LangDLL.dll
Size 4KB
Sample240605-eql18sdg3z
SHA256 e80cfa37169aecfee7d91508d1025706294d47b2950debf2c31e6ba52f3b8cf9
MD5 6e8035da51e2512fb88440d8d94ac38a
SHA1 c7e96e638450a40cb163b66ff60300e143940921
SHA512 1b8c849676d64b7e380aa884f3688ed1e6544aa4cd54a998522195d877e7a4c3071ff4fcc1478cd3afd1f77e89bee12faefe85db056d496d42a047801d69bcfd
SSDEEP 96:34Nr2mIDHfLfzMUyJ1Cb/zdYumvhTHVYE:I12mIHYUy4/RBiK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	4272	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4272	3840	rundll32.exe	83
PID 3840 wrote to memory of 4272	3840	rundll32.exe	83
PID 3840 wrote to memory of 4272	3840	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 600
    3⤵
    - Program crash
    PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4272 -ip 4272
1⤵
PID:4860