a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479

Analysis

max time kernel
117s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Target

IDA-Pro-7.7-main/python38/_ctypes.dll
Size

124KB
MD5

291a0a9b63bae00a4222a6df71a22023
SHA1

7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256

820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512

d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09
SSDEEP

3072:psrzScwzPzuoUxXVxQXKIAqoFQufLTA/1mj9AItH5IIBPmQl:a//wWX8XKIABfLTcmXlyk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1308	2512	rundll32.exe	29
PID 2512 wrote to memory of 1308	2512	rundll32.exe	29
PID 2512 wrote to memory of 1308	2512	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_ctypes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 132
  2⤵
  PID:1308