e60aea3de7a184da9ffe6ab259ac9d8df4f766b7073425e1b9a0c38cba47e6a0

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 16:16

Target

$PLUGINSDIR/ExecDos.dll
Size

5KB
MD5

a7cd6206240484c8436c66afb12bdfbf
SHA1

0bb3e24a7eb0a9e5a8eae06b1c6e7551a7ec9919
SHA256

69ac56d2fdf3c71b766d3cc49b33b36f1287cc2503310811017467dfcb455926
SHA512

b9ee7803301e50a8ec20ab3f87eb9e509ea24d11a69e90005f30c1666acc4ed0a208bd56e372e2e5c6a6d901d45f04a12427303d74761983593d10b344c79904
SSDEEP

48:6jOBtU/BXN8kUByyy/Aklkcrkyg7Vg5RibGoTCTo0gqVeeaeQqzM5rv774YRljmB:y/DMy4ncrkyg7tbpQFLUEYRxe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2348	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 1988 wrote to memory of 2348	1988	rundll32.exe	31
PID 2348 wrote to memory of 2172	2348	rundll32.exe	32
PID 2348 wrote to memory of 2172	2348	rundll32.exe	32
PID 2348 wrote to memory of 2172	2348	rundll32.exe	32
PID 2348 wrote to memory of 2172	2348	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 224
    3⤵
    - Program crash
    PID:2172