Analysis
-
max time kernel
420s -
max time network
443s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
20-07-2024 15:28
General
-
Target
$APPDATA/cl/python27.dll
-
Size
2.3MB
-
MD5
9d7f84a3795bacba4403c1e64f6bc932
-
SHA1
6a27015451a02957034834cee005c0de0ba7151e
-
SHA256
fe5e626e467226bd250717c66944950371f74cc83b60425644cd2e95616376de
-
SHA512
c723a6e977f5d02477d1c5999290c875fa5e18b60367c5d21131595ad8b082edba26b006c9d788a98aac9283857f3483c32cac2e332f9676041a87d255f59360
-
SSDEEP
49152:5kSX6jb5rHEDLBPDu0SVM+RfRYhaTH3IP4H4yn0MdAPYKCW/UL94:aS+x0X4fzYQHR0MdbroK94
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\cl\python27.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\cl\python27.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 6163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3132 -ip 31321⤵