896c7582c90c506fb0c3fc69ed4e81266a47129f79682d89f76a5583c0113efa

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 05:07

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

b26b412d9f1050ad53f663c972fdcd9f
SHA1

7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256

70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512

ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
SSDEEP

48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 2796 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1660	2796	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 2796	1304	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1660	2796	rundll32.exe	WerFault.exe
PID 2796 wrote to memory of 1660	2796	rundll32.exe	WerFault.exe
PID 2796 wrote to memory of 1660	2796	rundll32.exe	WerFault.exe
PID 2796 wrote to memory of 1660	2796	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 224
3⤵
- Program crash
PID:1660