9b73f8eb1505799749b1b15c7a9ed63448f6b7658a2ef912dc4ce2b57b38ad7d

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:38

Target

$PLUGINSDIR/ExecDos.dll
Size

5KB
MD5

a7cd6206240484c8436c66afb12bdfbf
SHA1

0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
SHA256

69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
SHA512

b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
SSDEEP

48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2172	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2032 wrote to memory of 2172	2032	rundll32.exe	28
PID 2172 wrote to memory of 2204	2172	rundll32.exe	29
PID 2172 wrote to memory of 2204	2172	rundll32.exe	29
PID 2172 wrote to memory of 2204	2172	rundll32.exe	29
PID 2172 wrote to memory of 2204	2172	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 224
    3⤵
    - Program crash
    PID:2204