0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
4294208s
max time network
146s
platform
windows7_x64
resource
win7-20220311-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

node_sqlite3.dll
Size

275KB
MD5

4ef8392550dea714b50f6c820e707c78
SHA1

6aee464956b76809ab24f4841ba64cae7a683f05
SHA256

e866f4418d86319f07a809904d8bce0c095ba858976078fcdaf7a23681b62f11
SHA512

b2edbcb2ccf0dd88277d49a52fb4c7f39f2858a4efe6282b62888d35af88dfc0653f884299b340d121b79c71bc49f091ce059b308f70c575210ed35aedf5de5f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

560 1636 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1636	1056	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 560	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 560	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 560	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 560	1636	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\node_sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\node_sqlite3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 268
3⤵
- Program crash
PID:560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-56-0x0000000000000000-mapping.dmp

Download
memory/1636-54-0x0000000000000000-mapping.dmp

Download
memory/1636-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download