One Day Sec

Why did the initial POC cause multiple calc.exe launches and system crash, and how was it fixed?

The DLL’s DllMain spawned calc.exe every time it was loaded, and because many processes invoke CAccPropServicesClass repeatedly, multiple instances of calc.exe launched, eventually crashing the system. The fix added a mutex (named "myself") using CreateMutex to ensure the payload runs only once per session. This optimization mirrors techniques used in other persistence methods like using Logon Scripts.
mutexDllMaincalc.execrashoptimization

Browse all Q&A →