a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Target

IDA-Pro-7.7-main/python38/_bz2.dll
Size

85KB
MD5

a49c5f406456b79254eb65d015b81088
SHA1

cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256

ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512

bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae
SSDEEP

1536:eKpLuz7t0fjOUSKdvOKJbdV/qj1M9D8WAPpP3JuFIIMVRy7:VizTTmbJJV/qj1M6WAPpP3JuFIIMVI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2884	2276	rundll32.exe	28
PID 2276 wrote to memory of 2884	2276	rundll32.exe	28
PID 2276 wrote to memory of 2884	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_bz2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2276 -s 96
  2⤵
  PID:2884