05f4df533dce0752fa82547bf93d1b4b7db6ce942e24e86e50ba4c7d76af3052

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 07:10

Target

NPLANGUAGE.dll
Size

244KB
MD5

143a8f0525c97e69bb07125943dabfd3
SHA1

88600140196c8fd02d1c12ba829196723ed57b4c
SHA256

b4fffe42456eb1f66a6b0ba2279fa4588f101812df8b4787c9a3771da6dba3b4
SHA512

fab280618c1e98b525f60ad4c6bb8f6391ec090bab734781b77d20edf4a1a7c19408c8a413e88baeb23a2a868f9bd825d95f0df7aef66e85e70a6b186dacdf22
SSDEEP

3072:XSkD7znCjYoomzI1aZ3/ceFRV+pG/P0Cac+M1JkO8GJQ7k+Xgso4:XzD3MYoomzwaZzFRopW0Rc+MrktG+k3E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2608	3096	rundll32.exe	82
PID 3096 wrote to memory of 2608	3096	rundll32.exe	82
PID 3096 wrote to memory of 2608	3096	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NPLANGUAGE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NPLANGUAGE.dll,#1
  2⤵
  PID:2608