51d227153368cf8a5f4c641ccff91c98af70389f31a8f0b56c2a541cdcd07b2b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 13:57

Target

$PLUGINSDIR/ExecDos.dll
Size

5KB
MD5

ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1

17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA256

d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
SHA512

5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP

48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	2368	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 1876 wrote to memory of 2368	1876	rundll32.exe	28
PID 2368 wrote to memory of 2384	2368	rundll32.exe	29
PID 2368 wrote to memory of 2384	2368	rundll32.exe	29
PID 2368 wrote to memory of 2384	2368	rundll32.exe	29
PID 2368 wrote to memory of 2384	2368	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 220
    3⤵
    - Program crash
    PID:2384