05ebd4268b70248a93d4e8d3ba3d72d97b5f6aab30f31c6071d5a0aa9662962a

Resubmissions

18-07-2024 15:19

18-07-2024 14:47

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 14:47

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

50016010fb0d8db2bc4cd258ceb43be5
SHA1

44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA256

32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512

ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP

48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1968	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 2108 wrote to memory of 1968	2108	rundll32.exe	31
PID 1968 wrote to memory of 1728	1968	rundll32.exe	32
PID 1968 wrote to memory of 1728	1968	rundll32.exe	32
PID 1968 wrote to memory of 1728	1968	rundll32.exe	32
PID 1968 wrote to memory of 1728	1968	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 220
    3⤵
    - Program crash
    PID:1728