0891ddb6b4cf9b491981c9065e734f302613c64828c811b8742a85e25fa7f60c

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 14:20

Target

$PLUGINSDIR/LangDLL.dll
Size

5KB
MD5

7344a89ef365ee3cb14e3ce465257a17
SHA1

5714b1b7e16225a23dad0ef5d10ec6382553e05b
SHA256

e53b5f58dd9e1a25a973efc378b552e15fda6e79b3fc67062f556967865a8bef
SHA512

5d993ccc6e66d728902c375facfc0e3df8f45773eedbcb043f81d755ad33b6e29d1d39be0fb446bc4f49dcbbcc3e8a875c793985c9ed1595f407930e63f37c91
SSDEEP

48:SnrQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJeABofgMGKO:fz+MM4eqmvz0JScx56mpwzAhWWGV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2468 1056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2468	1056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 956 wrote to memory of 1056	956	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2468	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2468	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2468	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 2468	1056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 224
3⤵
- Program crash
PID:2468