0edbb60d12b7f5603b13bfbb8644a167ffb317fa1aef8f276006b8bfabfaf223 | Triage

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:25

Sharing

Report Analysis Logs

General

Target

WindowsTask/sqlite3.dll
Size

949KB
MD5

25ceb85fe07b6357db0b2fbbf8783e3f
SHA1

c7246b43ce4c719fcce168148c311575df3b1d4d
SHA256

56b141d0170265f46ae13377aa847da5014fed50275f7d8f525327a1612d9286
SHA512

66991d88c6c080a8537d0548e95c164b133c36b2fa63347ad70b5b15979db559398b5049805be31b12d332198c4856f41790dc0471b0faa2069810dccb622df7
SSDEEP

24576:S4QF+VKLKgZLO7K6HTPUEzHC1SSaCNbKujfDN:BHVKGz79bzHC1SSlNbKGDN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28
PID 2668 wrote to memory of 2648	2668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsTask\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsTask\sqlite3.dll,#1
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads