a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Target

IDA-Pro-7.7-main/python38/_lzma.dll
Size

159KB
MD5

cf9fd17b1706f3044a8f74f6d398d5f1
SHA1

c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256

9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512

5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a
SSDEEP

3072:LIVa3V86CLON9lUm+/3i4p9qZqznfY9mNovvFOhYIlLvyFIID15x:LIVa3V81LwlC//q+gYOvPIBvy7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1632	2032	rundll32.exe	16
PID 2032 wrote to memory of 1632	2032	rundll32.exe	16
PID 2032 wrote to memory of 1632	2032	rundll32.exe	16

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2032 -s 96
1⤵
PID:1632

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_lzma.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032