5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 14:05

Target

portable/python27.dll
Size

2.5MB
MD5

b3ed66d9feb5c35b674fd3da07a382e1
SHA1

bf04cda92f16c226a1250b1292e9efeae1e135e8
SHA256

f25366c11e63c4912bb46bbaa60d0a98e6164ead586f125d9ed4255d04d914ae
SHA512

fc8d656a407265320053c213591b4dfda720b5115857d068b587356bd686d77ef94352c1f62e0238c6df83caa53d3a5bbe8a2b6051909a19a72796c9e0a4d94e
SSDEEP

49152:RpG1BkE5T3Ezr57DfqPRHfVX8dswLmwbr5oLEdeOPln4MdWHFdtSIqOTDjl+ey3e:W17HfVX6sAmwX98Q4MgHrt7qYZF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1588	1948	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1956 wrote to memory of 1948	1956	rundll32.exe	27
PID 1948 wrote to memory of 1588	1948	rundll32.exe	28
PID 1948 wrote to memory of 1588	1948	rundll32.exe	28
PID 1948 wrote to memory of 1588	1948	rundll32.exe	28
PID 1948 wrote to memory of 1588	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\python27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\python27.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 228
    3⤵
    - Program crash
    PID:1588