f694c1d55813834d0a08eeb421359220a82929a1c0c614acadc58b4ef1c4b5df

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/06/2024, 16:37

Target
$PLUGINSDIR/LangDLL.dll
Size 5KB
Sample240622-t5adbavbnf
SHA256 c66b568cd675806a499273e3e8aeda350425aac17fc24342ed54e477417cdc0f
MD5 8c909780802ac2097ea4132e6375acd2
SHA1 b35fbda0725d7c66281d5c340b53eb5d54922583
SHA512 e94a37c586e55de8b61b427c14a385dcc57f3602d3dace90ad4663609da14a922cb78f76a58ed211549e987ba6f130cf2581eb48bcad2c9c25c6dc93a7ff6d08
SSDEEP 48:SnTGmVN7ZTPUptxEwvBqAKxwLJXyTpXieN2JVGLalmQ2lUmiwag/nDGkaEJlof6P:+7ZDGEQ9LJX6weN2TuXQ2lBiwag/np/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	3024	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 3024 wrote to memory of 2044	3024	rundll32.exe	29
PID 3024 wrote to memory of 2044	3024	rundll32.exe	29
PID 3024 wrote to memory of 2044	3024	rundll32.exe	29
PID 3024 wrote to memory of 2044	3024	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 224
    3⤵
    - Program crash
    PID:2044