Differential Fault Analysis of AES
Your fault attack scenario correspond to this paper :

A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret &amp; Quisquater - CHES 2003)

This paper describe how to retrieve four bytes of the last round key with at least two pairs of ciphertext/faultytext.

Each pair of ciphertext $C$ and faultytext $C^*$ could be written as $C^* = C \oplus E$, where $E$ contains 4 bytes $\neq 0$.

For more details, the attack consists on several steps :


Compute a list $L$ of 4x255 possible differences after the MixColumns of Round 9
Guess 4 parts of $K_{10}$
Compute $d = SB^{-1} (C \oplus K_{10}) \oplus SB^{-1} (C^* \oplus K_{10})$
If $d$ in $L$, add guessed $K$ in a list of possible candidates of $K_{10}$
Repeat for each pair, considering only guessed $K$ in the list of possible candidates, if $d$ is not in $L$ for the new pair, remove the candidate.
Repeat until the list of possible candidates is reduced to one.