a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479

Analysis

max time kernel
4s
max time network
43s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Target

IDA-Pro-7.7-main/python38/_decimal.dll
Size

262KB
MD5

a2b554d61e6cf63c6e5bbafb20ae3359
SHA1

26e043efdaaa52e9034602cebeb564d4f9714a7f
SHA256

30eea56a4d1dd78f9d65fcb6168ab189cfa8098c38aad47ee770756a056749ca
SHA512

5ea99fa23e7657e9f01dc155741d5f93945a2e6c90f1494873aa7c35a8da0001815b31b387b239ef7de1695b8f416028166dd94db259d246d8dc10a37e20da97
SSDEEP

6144:OLYg4UlD9GwglHVbM+J3OFBwsgW8w9NoL+Tv9qWMa3pLW1AHGZJXOSRQOGONHPj1:O3lD9GwUVZowsgWP/oL+dAZBR1vjYM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2680	2776	rundll32.exe	30
PID 2776 wrote to memory of 2680	2776	rundll32.exe	30
PID 2776 wrote to memory of 2680	2776	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_decimal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 100
  2⤵
  PID:2680