6b189ad141b75544c1ab7cf29db7d5bb4d570d045d0b99556bc3e742dc0a3a37

Resubmissions

11-04-2024 05:25

11-04-2024 01:54

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 05:25

Target

$PLUGINSDIR/ExecDos.dll
Size

6KB
MD5

d7b975049ec3aba50e4b7cc654a28214
SHA1

25f2578945ebc9ac037fef7b7f94c5d48e42388b
SHA256

42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
SHA512

f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
SSDEEP

96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2220	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 220
    3⤵
    - Program crash
    PID:2224