44c7c1f27dcf91c95973812e85872f7ddb471fc66b1d20fb8cc581ce1c222b8e

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/06/2023, 07:18

Target

goldsql.dll
Size

1.5MB
MD5

1bd705b4ebf68c70d1853bb77baec631
SHA1

9aa041c4e52500779709041e79728be6ac29a9d1
SHA256

44c7c1f27dcf91c95973812e85872f7ddb471fc66b1d20fb8cc581ce1c222b8e
SHA512

ed9dc76dc19008a80402ca24ec6d629a7af746083716eaceb3592aa53042b0be7a2c60a5db17410e10d7c29cb5f1d398a5394b88d21e450005d7804fbd20ab68
SSDEEP

24576:G+vPpsL6f2RMSdgOvRGr3DW2L0jfHFGr4rt1w8AQkLJhcCfekExReun0AV+:PymfqLKOvRGr3DW2L07UsZ1XAQYJREJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	1988	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1960	1988	rundll32.exe	28
PID 1988 wrote to memory of 1960	1988	rundll32.exe	28
PID 1988 wrote to memory of 1960	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\goldsql.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 168
  2⤵
  - Program crash
  PID:1960