e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 04:15

Target
$PLUGINSDIR/LangDLL.dll
Size 7KB
Sample240611-evdknavbpp
SHA256 32487e83679c88f63f35a9989e58ef3a3084bd70b6ebe76cda459c92ebf2c066
MD5 ccb909b48488ac50078b994947cf855c
SHA1 08ef6ff2b4df6de0bdc443611815a8db619b6c70
SHA512 ebe5dece02bd459d8d28457fe082bc759c21c0bb641ed31a848e2b521bfd9d2544585b0acbb1dfd08a5a9b91a91bba5aa5339c0f736fd153f852af17144caac8
SSDEEP 96:X80Gzrjk9CYIh6SnCQ5ygkSoZrtjlPVng1/GsoJoiB:DGbeINnC4oZrjPdIOjqi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	2252	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2276 wrote to memory of 2252	2276	rundll32.exe	28
PID 2252 wrote to memory of 1632	2252	rundll32.exe	29
PID 2252 wrote to memory of 1632	2252	rundll32.exe	29
PID 2252 wrote to memory of 1632	2252	rundll32.exe	29
PID 2252 wrote to memory of 1632	2252	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 224
    3⤵
    - Program crash
    PID:1632

memory/2252-0-0x000000006F100000-0x000000006F108000-memory.dmp

Download