9ef929399eb29c3c23cb999d37c1a0bdef71386e4917d90baffe64e34f603939

Analysis

max time kernel
477s
max time network
590s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2023, 05:05

Target

Tool Reg Gmail/SQLite.Interop.dll
Size

1.4MB
MD5

0525b5757ad04d177e4719e56b8ebddf
SHA1

f11d11c9fe963e036fbfe97ad38bfb0f3d1019c8
SHA256

b9eb73e402eecb65ce535d505c0c425213f938188f1ff5c53889fca732445167
SHA512

7316d092d8be69137e994c8f3caa93317ce1546bb8d5ab596854a61e6a1d5220b47355dc7a124154d1dd0e72646ab7e036e387b66e49a9d6a6698804ae0faa28
SSDEEP

24576:Ptps7FIyx/k5GBPpeXgNxHo3sRY65f9CRPchGrWHE5l7991wJN5R1la8ISuqDIR1:MTk5Y2KRTCI6ElRXa8I5Dai

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	1464	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 1464	4564	rundll32.exe	81
PID 4564 wrote to memory of 1464	4564	rundll32.exe	81
PID 4564 wrote to memory of 1464	4564	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Tool Reg Gmail\SQLite.Interop.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Tool Reg Gmail\SQLite.Interop.dll",#1
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 648
    3⤵
    - Program crash
    PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1464 -ip 1464
1⤵
PID:1448