91016984262cedda07af646847e832fc0f961d70c22a0fc79a400f253aae9cd7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 05:40

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

8c909780802ac2097ea4132e6375acd2
SHA1

b35fbda0725d7c66281d5c340b53eb5d54922583
SHA256

c66b568cd675806a499273e3e8aeda350425aac17fc24342ed54e477417cdc0f
SHA512

e94a37c586e55de8b61b427c14a385dcc57f3602d3dace90ad4663609da14a922cb78f76a58ed211549e987ba6f130cf2581eb48bcad2c9c25c6dc93a7ff6d08
SSDEEP

48:SnTGmVN7ZTPUptxEwvBqAKxwLJXyTpXieN2JVGLalmQ2lUmiwag/nDGkaEJlof6P:+7ZDGEQ9LJX6weN2TuXQ2lBiwag/np/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	1908	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 2548 wrote to memory of 1908	2548	rundll32.exe	30
PID 1908 wrote to memory of 2404	1908	rundll32.exe	31
PID 1908 wrote to memory of 2404	1908	rundll32.exe	31
PID 1908 wrote to memory of 2404	1908	rundll32.exe	31
PID 1908 wrote to memory of 2404	1908	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 224
    3⤵
    - Program crash
    PID:2404