d58e89fb349366c78287a046823e7392261ca8d6d9b0e93c9a867308986b4398

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:27

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

1775e8fe7832f0351d4024ba3478c58d
SHA1

3a2aafd8275f384332f6d08224d927040ce37cb4
SHA256

a2a159540c738c7bc4d6ce8dd203bf859078409c0021a2a60f4b0faa5352d375
SHA512

362cda0e1f50a8fecde1611863b1c6218962e3ec198ce3641ce50910d400ac647cdc3742888140fd6817ce6b30d83865aa0c72292bb80b1ae86cab419e0fb2b7
SSDEEP

48:qV9AvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptqGUaEJyof5d2:S11GED5ZTvycNSmwVsTJuft+Fd2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2140	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2136 wrote to memory of 2140	2136	rundll32.exe	29
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30
PID 2140 wrote to memory of 2152	2140	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 224
    3⤵
    - Program crash
    PID:2152