1
2
3
4
5 from lib.common.abstracts import Package
6 from lib.api.process import Process
7 from lib.common.exceptions import CuckooPackageError
8
10 """EXE analysis package."""
11
13 free = self.options.get("free", False)
14 args = self.options.get("arguments", None)
15 dll = self.options.get("dll", None)
16 suspended = True
17 if free:
18 suspended = False
19
20 p = Process()
21 if not p.execute(path=path, args=args, suspended=suspended):
22 raise CuckooPackageError("Unable to execute initial process, "
23 "analysis aborted")
24
25 if not free and suspended:
26 p.inject(dll)
27 p.resume()
28 p.close()
29 return p.pid
30 else:
31 return None
32
35
37 if self.options.get("procmemdump", False):
38 for pid in self.pids:
39 p = Process(pid=pid)
40 p.dump_memory()
41
42 return True
43