2412523a24c46311eb73b02fa8c01c486bd2e5fee2cacf8706e9fba9eddd5091

Analysis

max time kernel
153s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 02:41

Target

$PLUGINSDIR/ExecDos.dll
Size

5KB
MD5

ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1

17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA256

d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
SHA512

5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP

48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	2272	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2272	3768	rundll32.exe	15
PID 3768 wrote to memory of 2272	3768	rundll32.exe	15
PID 3768 wrote to memory of 2272	3768	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 608
  2⤵
  - Program crash
  PID:2444

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2272 -ip 2272
1⤵
PID:3564