2121dd17a15c940eb55be2582dab5a255ea099c56ef41c1440270380bfa6842a | Triage

Analysis

max time kernel
14s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-05-2023 13:35

Sharing

Report Analysis Logs

General

Target

InstAccountsManager/x86/SQLite.Interop.dll
Size

999KB
MD5

528f9d75f604283de2d35be9474b4e33
SHA1

423fd25dd31ffdb2e682ad0151e0bc951b90d78a
SHA256

d3c8fc8da086a1ebf1b3db8f2192aaeccdb307bec78cd0224dac9c47afa4c384
SHA512

800caba4ef7d2927e6d081f066a1ddf149191567f03bff278f3e448d7fb2e38600168512b17d76bf957c5596ab112a8e7ab41d10f806d1a559e51975b0339491
SSDEEP

24576:Vp7OahszQfZUS0qIL0rK2hjbbFToUcdGf:k3ArxJe8f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe
PID 1788 wrote to memory of 1992	1788	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstAccountsManager\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstAccountsManager\x86\SQLite.Interop.dll,#1
2⤵
PID:1992

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...