b43b3fb42e824d41c7e2e4f4af1c40f591e6dccd9148d6e677d4ef71d9b94940

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 16:16

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

ebd0da54db9f12ffd15206cc24355793
SHA1

910be3bebdde55eb1ce05915a79f01ebdc622786
SHA256

4066a0cbd9f6bb13c0f6fb064d4647ef7bc68a1be3d0caa4460b5ffd9ed1e0e6
SHA512

cee09db96267b1a30477ff074988606bdf35f9a5aa798a9a10029b11c0c347ab42a124320d777acde458828954cc8cf1a489b1673b31d589cdc4f50d4b86659d
SSDEEP

48:im1wsjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0J9of5d2D:F18Bl91Z7/ycNSCwV8TLZR0ed2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2984	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2872 wrote to memory of 2984	2872	rundll32.exe	28
PID 2984 wrote to memory of 2284	2984	rundll32.exe	29
PID 2984 wrote to memory of 2284	2984	rundll32.exe	29
PID 2984 wrote to memory of 2284	2984	rundll32.exe	29
PID 2984 wrote to memory of 2284	2984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 224
    3⤵
    - Program crash
    PID:2284