2163394fe3e8a630cebd0f44e57c1fea5890a24773327db138a72ee1886eb263

Analysis

max time kernel
93s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 10:55

Target

$PLUGINSDIR/LangDLL.dll
Size

8KB
MD5

313661ec12ed5ce1fd0b3292bf02cb69
SHA1

fd341676cf680a9f0f690c35b43feadc0693e9a8
SHA256

2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
SHA512

a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
SSDEEP

96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
908	4364	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4364	4168	rundll32.exe	84
PID 4168 wrote to memory of 4364	4168	rundll32.exe	84
PID 4168 wrote to memory of 4364	4168	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 600
    3⤵
    - Program crash
    PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4364 -ip 4364
1⤵
PID:540

memory/4364-0-0x0000000074950000-0x000000007495A000-memory.dmp

Filesize
40KB

Download