535930bd0cd42da35da4bbbd15007f83e051a630141b0bcf6df50c2269ad3d27

Resubmissions

04/07/2023, 13:16

04/07/2023, 13:11

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 13:16

Target

CookieEnjoyer/x64/SQLite.Interop.dll
Size

1.7MB
MD5

a73fdfb6815b151848257eca042a42ef
SHA1

73f18e6b4d1f638e7ce2a7ad36635018482f2c55
SHA256

10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d
SHA512

111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d
SSDEEP

24576:EpmVXSlb6q7SKjK2RMP1lfuqluu3cAG8WqMkXbbz38MJBbMNCoUpgLPNwEcIMK:6mVXy7SKjyfTFMwEkr3VJBbKCoUYt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	852	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 920	852	rundll32.exe	28
PID 852 wrote to memory of 920	852	rundll32.exe	28
PID 852 wrote to memory of 920	852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CookieEnjoyer\x64\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 852 -s 116
  2⤵
  - Program crash
  PID:920