1472780b22a70f13e6aec3ffd06fc9714748841f9f88c3c3b743d247d9711d68

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:09

Target

$PLUGINSDIR/ExecDos.dll
Size

5KB
MD5

a7cd6206240484c8436c66afb12bdfbf
SHA1

0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
SHA256

69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
SHA512

b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
SSDEEP

48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2396	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2108 wrote to memory of 2396	2108	rundll32.exe	28
PID 2396 wrote to memory of 2912	2396	rundll32.exe	29
PID 2396 wrote to memory of 2912	2396	rundll32.exe	29
PID 2396 wrote to memory of 2912	2396	rundll32.exe	29
PID 2396 wrote to memory of 2912	2396	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 224
    3⤵
    - Program crash
    PID:2912