d58e89fb349366c78287a046823e7392261ca8d6d9b0e93c9a867308986b4398

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:27

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

1775e8fe7832f0351d4024ba3478c58d
SHA1

3a2aafd8275f384332f6d08224d927040ce37cb4
SHA256

a2a159540c738c7bc4d6ce8dd203bf859078409c0021a2a60f4b0faa5352d375
SHA512

362cda0e1f50a8fecde1611863b1c6218962e3ec198ce3641ce50910d400ac647cdc3742888140fd6817ce6b30d83865aa0c72292bb80b1ae86cab419e0fb2b7
SSDEEP

48:qV9AvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptqGUaEJyof5d2:S11GED5ZTvycNSmwVsTJuft+Fd2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
448	1756	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1756	5032	rundll32.exe	90
PID 5032 wrote to memory of 1756	5032	rundll32.exe	90
PID 5032 wrote to memory of 1756	5032	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 600
    3⤵
    - Program crash
    PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1756 -ip 1756
1⤵
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4012,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
1⤵
PID:868