85cb565aba61c39ecf383bb70128742d92e0f48997860fd6a15f2749d7bd7e69

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 16:52

Target

VCE1.0.2（软件会提示升级，勿升级）/sqlite3.dll
Size

516KB
MD5

516277cb96a0e7e9c33b7f29b73c31d2
SHA1

a627411e5302605f029ed9f21f8f972ff9150bf2
SHA256

d9c61f07751d4b2f52fa3dd7bad80fb0573abfb9e11ec1162517f8f75701782a
SHA512

27a03f71089e5c3a9f673aa42fe7f71f20d7855ecb26e158ffa67e6b33e0ace68dc80c28cecbf6cb3bdda1f314c3ffa59f66549c7a0d7a963c61092cf1b3aa57
SSDEEP

12288:0iTjR6kna/KzsHIoufPiL5JXjKaarzWovTSmja9q96fQkw8dwn:0m8NCzsooOPiXT6rSov2mjVw3wD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 944 WerFault.exe rundll32.exe

pid	pid_target	process	target process
900	944	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 1696 wrote to memory of 944	1696	rundll32.exe	rundll32.exe
PID 944 wrote to memory of 900	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 900	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 900	944	rundll32.exe	WerFault.exe
PID 944 wrote to memory of 900	944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCE1.0.2（软件会提示升级，勿升级）\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCE1.0.2（软件会提示升级，勿升级）\sqlite3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 224
3⤵
- Program crash
PID:900

memory/900-56-0x0000000000000000-mapping.dmp

Download
memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download