50a8a27c3936baf64013435a27409f53abb3376327dbeef67aeadcfc89f70093

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 11:37

Target
$PLUGINSDIR/ExecDos.dll
Size 5KB
Sample240315-nrdwpafc6y
SHA256 b772c4d8112d1ff086ad4ba529cc802ff8f503d9003c9c73088a0240f4ba0523
MD5 375aeda248e605b726ef5f256bee34c0
SHA1 cc29301f845fc430357a660708ed8cf972d37b43
SHA512 18de4580af9298753f579eafeb083321710640c4db7d77a32ff870ebb5cc81eb5b252c7e3f6a1c448ed4f96e8a230eb3225c294f168d37821aed26699f17d7c9
SSDEEP 96:rA8uCTy0luh/H1s3ZJQ8JXHdKAeQ/YUDJhn:TTLuhVcJbdHdvLJzn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2676	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2968 wrote to memory of 2676	2968	rundll32.exe	28
PID 2676 wrote to memory of 2944	2676	rundll32.exe	29
PID 2676 wrote to memory of 2944	2676	rundll32.exe	29
PID 2676 wrote to memory of 2944	2676	rundll32.exe	29
PID 2676 wrote to memory of 2944	2676	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 228
    3⤵
    - Program crash
    PID:2944