MEDIUM Suspicious Process Creation

Prevented (Blocked) ID: #708 | Detected: 2026-01-01 12:18:21 | Malware
View Incident Back
Alert Overview

Suspicious process creation detected

Unclassified
XDR Agent
New
DS:PANW/XDR Agent DOM:Security
Host Information
dwshin
172.27.1.39
dwshin
c6295532ef1e41f091e6a73ea66f6100
5c:b4:7e:be:8e:58
Process Information Process Execution
Actor Process (Executor)
Process Name python.exe
Path C:\Users\andsi\AppData\Local\Python\pythoncore-3.14-64\python.exe
PID 9508
SHA256 fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a VT
MD5 9bd26657353d7441a72f29ab43f1fd37
Signature Python Software Foundation N/A 
"C:\Users\andsi\AppData\Local\Python\pythoncore-3.14-64\python.exe"   mega_incident_generator.py --fast --rounds 1
Action Process (Target)
Process Name cmd.exe
SHA256 64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4 VT
Signature Microsoft Windows Signed 
C:\Windows\system32\cmd.exe /c "procdump -ma lsass.exe C:\Users\andsi\AppData\Local\Temp\lsass.dmp"
Quick Actions
View Related Incident View Endpoint Check Hash on VirusTotal Back to Alerts
Severity Analysis
MEDIUM

Review and assess impact

Summary
Events 1
IP Addresses 1
Tags 2
File Artifacts Yes
Network Artifacts No
Registry Artifacts No
Analyst Verdict