a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Target

IDA-Pro-7.7-main/python38/_msi.dll
Size

39KB
MD5

db20799923c444311ff09eb3b8b0f5a0
SHA1

494aa7f512b1803668d54edc2e7ed39d331fdf81
SHA256

52f3adf011b2e6da14e0ae5d13637d35f98951d0c0077d3b4a70ed514dc68b6b
SHA512

648c30a173d9d9e1cfced74c777d9116aeab4d0f25d5d8f6a9fd0fc0b7c4c430822bac17ab8a505ec55978e653cab9efc63fe4ab9fde40f7ad71415704245aee
SSDEEP

768:b2uXan3nSr/5LsAzGqKVW4q6CwxoUAIZdeoLuMl6QUtmFIIMGhDG4yMfh3:PKijZVKVW4q6Cu6QLFIIMGjyM9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1728	864	rundll32.exe	16
PID 864 wrote to memory of 1728	864	rundll32.exe	16
PID 864 wrote to memory of 1728	864	rundll32.exe	16

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 864 -s 132
1⤵
PID:1728

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_msi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864