1
2
3
4
5 from lib.common.abstracts import Package
6 from lib.api.process import Process
7 from lib.common.exceptions import CuckooPackageError
8
10 """DLL analysis package."""
11
13 free = self.options.get("free", False)
14 function = self.options.get("function", "DllMain")
15 arguments = self.options.get("arguments", None)
16 dll = self.options.get("dll", None)
17 suspended = True
18 if free:
19 suspended = False
20
21 args = "{0},{1}".format(path, function)
22 if arguments:
23 args += " {0}".format(arguments)
24
25 p = Process()
26 if not p.execute(path="C:\\WINDOWS\\system32\\rundll32.exe", args=args, suspended=suspended):
27 raise CuckooPackageError("Unable to execute rundll32, "
28 "analysis aborted")
29
30 if not free and suspended:
31 p.inject(dll)
32 p.resume()
33 return p.pid
34 else:
35 return None
36
39
41 if self.options.get("procmemdump", False):
42 for pid in self.pids:
43 p = Process(pid=pid)
44 p.dump_memory()
45
46 return True
47