a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479 | Triage

Analysis

max time kernel
118s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Sharing

Report Analysis Logs

General

Target

IDA-Pro-7.7-main/python38/_multiprocessing.dll
Size

29KB
MD5

5cadb7186df07ca4ca5a8654cb00c9f1
SHA1

513b9160a849a3d7d510f59ffa5e201809d0161b
SHA256

54c28dcf2f2a72fc854f49c76fb021bbf2b53675fe5b5ed021c61efe9467197b
SHA512

f853c618ca243b5da04e53079d3e6a0c6a9e4e358bb5020196b49638f28bf4171a487db7ce0e5e2c46df6a643c04434f967f1c614086121d1edddcf891f5a409
SSDEEP

768:JyJ9dDNuElddhJDueNIIAtWSDG4yBvWLhq:Jg3bJDueNIIAtW2yNB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2232	2112	rundll32.exe	30
PID 2112 wrote to memory of 2232	2112	rundll32.exe	30
PID 2112 wrote to memory of 2232	2112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_multiprocessing.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 108
  2⤵
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads