d420540207850c58f2773f0f31ded2193a532c22f2f6a2634960d82959dc3591 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 12:05

Sharing

Report Analysis Logs

General

Target

°/sqlite3.dll
Size

668KB
MD5

226b9d3db8347f03f3283caa1fb88314
SHA1

a34a16c6f5c0dd71559d5a9bcbce10cceec2f208
SHA256

3734090ded8e156b6fbf1d64097a4c3cc9b23616d8f41b3eebdb04c36bfca34a
SHA512

6248f459452515f23e3f01721ed06e0436a7a9bdd098eccb67865de24c16eb7118565f4fe6623a8c21e60e036999fe2d61b2c15f465be423350999f989ad541f
SSDEEP

12288:KGkZo6Ydg0cnMvHvy/6lEq53zYpq88p/+tSQrPD09RFRrvQh5JbvKIh48T:dVYpiGt59O8T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28
PID 1804 wrote to memory of 1780	1804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\°\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\°\sqlite3.dll,#1
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-54-0x0000000000000000-mapping.dmp

Download
memory/1780-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download