20bc0b559120e640d3c739f08a60d4d8e7db8ae88281b2d4301a342aedad4412

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 11:41

Target

$PLUGINSDIR/ExecDos.dll
Size

5KB
MD5

ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1

17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA256

d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
SHA512

5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP

48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	1740	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1768 wrote to memory of 1740	1768	rundll32.exe	28
PID 1740 wrote to memory of 2492	1740	rundll32.exe	29
PID 1740 wrote to memory of 2492	1740	rundll32.exe	29
PID 1740 wrote to memory of 2492	1740	rundll32.exe	29
PID 1740 wrote to memory of 2492	1740	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 224
    3⤵
    - Program crash
    PID:2492