c7c1e87f74a0a769fed8b305ce43f926bd68e02e80f40976698366baa045b0cf

Analysis

max time kernel
142s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 06:58

Target

$PLUGINSDIR/LangDLL.dll
Size

8KB
MD5

1290ff92e7d5e675ca7f982942a58d0a
SHA1

b5496bf231a99f52fc2225a27cec0cf9809b5bdc
SHA256

7986be3b9a6dd3f9c3236c2de7cda25a35567709374712b6201a73ca8820edfe
SHA512

6494e6a3c29b6baf45fcdc0a9bc188351b0d5d8956aa886fb0787806abb187edea0a0b4bd149749919b080cdca6aaf8235d7caede0fa269c89e1b7439eff856c
SSDEEP

96:ltgIeKipEy315DJY1+GnUC1Z4Ie18UdKXW3xOgbTO4udUI5aH71pj:XE2y315VYsGnUlIe18CKXWpO4qij

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2996	2656	rundll32.exe	28
PID 2656 wrote to memory of 2996	2656	rundll32.exe	28
PID 2656 wrote to memory of 2996	2656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 80
  2⤵
  PID:2996

memory/2656-0-0x000007FEFB610000-0x000007FEFB61B000-memory.dmp

Filesize
44KB

Download