517f321c489f68449571c735e9c1cbae5d3241a6872972b687be97d2b5d04903

Analysis

max time kernel
113s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 21:37

Target

NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222/x86/SQLite.Interop.dll
Size

792KB
MD5

9b19dcee960dc215e64b1d82348707a9
SHA1

9c1e0f76673eb385787120e17404df179316ca2b
SHA256

3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38
SHA512

cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d
SSDEEP

12288:iIF0SBEkDG7/jznRefvOIVcn4PW5d6PrVJNcdwLzs9w:iIYkDG7rznRenOIVc4PW76TbK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4052 wrote to memory of 3808	4052	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 3808	4052	rundll32.exe	rundll32.exe
PID 4052 wrote to memory of 3808	4052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222\x86\SQLite.Interop.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Fixed_Cracked By Alcatraz3222\x86\SQLite.Interop.dll",#1
2⤵
PID:3808