5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0

Analysis

max time kernel
92s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2023 14:05

Target

portable/python27.dll
Size

2.5MB
MD5

b3ed66d9feb5c35b674fd3da07a382e1
SHA1

bf04cda92f16c226a1250b1292e9efeae1e135e8
SHA256

f25366c11e63c4912bb46bbaa60d0a98e6164ead586f125d9ed4255d04d914ae
SHA512

fc8d656a407265320053c213591b4dfda720b5115857d068b587356bd686d77ef94352c1f62e0238c6df83caa53d3a5bbe8a2b6051909a19a72796c9e0a4d94e
SSDEEP

49152:RpG1BkE5T3Ezr57DfqPRHfVX8dswLmwbr5oLEdeOPln4MdWHFdtSIqOTDjl+ey3e:W17HfVX6sAmwX98Q4MgHrt7qYZF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	4288	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 4288	2704	rundll32.exe	82
PID 2704 wrote to memory of 4288	2704	rundll32.exe	82
PID 2704 wrote to memory of 4288	2704	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\python27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\python27.dll,#1
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 616
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4288 -ip 4288
1⤵
PID:4876