85cb565aba61c39ecf383bb70128742d92e0f48997860fd6a15f2749d7bd7e69

Analysis

max time kernel
54s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2022 16:52

Target

VCE1.0.2（软件会提示升级，勿升级）/sqlite3.dll
Size

516KB
MD5

516277cb96a0e7e9c33b7f29b73c31d2
SHA1

a627411e5302605f029ed9f21f8f972ff9150bf2
SHA256

d9c61f07751d4b2f52fa3dd7bad80fb0573abfb9e11ec1162517f8f75701782a
SHA512

27a03f71089e5c3a9f673aa42fe7f71f20d7855ecb26e158ffa67e6b33e0ace68dc80c28cecbf6cb3bdda1f314c3ffa59f66549c7a0d7a963c61092cf1b3aa57
SSDEEP

12288:0iTjR6kna/KzsHIoufPiL5JXjKaarzWovTSmja9q96fQkw8dwn:0m8NCzsooOPiXT6rSov2mjVw3wD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4796 4768 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4796	4768	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 4768	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 4768	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 4768	1108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCE1.0.2（软件会提示升级，勿升级）\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VCE1.0.2（软件会提示升级，勿升级）\sqlite3.dll,#1
2⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 600
3⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4768 -ip 4768
1⤵
PID:5112