33b311de8af4ec8d35462fffab89350f7d08277bcc98dda6fb148eff8cc36884

Analysis

max time kernel
7s
max time network
40s
platform
windows7_x64
resource
win7-20231215-de
resource tags

arch:x64arch:x86image:win7-20231215-delocale:de-deos:windows7-x64systemwindows
submitted
18-01-2024 20:17

Target

IDA Pro/ida.dll
Size

4.1MB
MD5

d5e960ffde42e89894753b68608442b4
SHA1

8b901a0ba3d0a36891244ab3bada7ed24e046778
SHA256

013235cbb26e7d5131b5c589c895beaed595052254f094ece42bc4a77fbc446b
SHA512

b87f5c55ab59baa224bcd19c4258475bff909c148ab206eea564c8c265d58c57f2d17624fe33a40480048d559c0aa0722f80a4e0ef6ad039c9b9ab11cd470b9c
SSDEEP

49152:X4ie0OLY7SMEAuDKQ3wNhdaG/GECAXjJVGnEWukv+N3yVYCazzrOPYubrmarAMFU:X4OGejwuXN3y+CqYYuHvq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3044 wrote to memory of 2548	3044	rundll32.exe	WerFault.exe
PID 3044 wrote to memory of 2548	3044	rundll32.exe	WerFault.exe
PID 3044 wrote to memory of 2548	3044	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\IDA Pro\ida.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 220
  2⤵
  PID:2548