e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0 | Triage

Analysis

max time kernel
1783s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25/02/2024, 20:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/sqlite3.dll
Size

1.1MB
MD5

b8074421d9f92adb9d112b90a54d47d1
SHA1

97eecbb5adb3d75d7ba791fc8625611e8854ee6e
SHA256

8ce20d2f27c6574dcaed648971778bb11d1ec18b9a44e879c0e53c1a29273dd8
SHA512

bef2881cd618c7a8a5871e6f58032ae81225f02bd005355d00ef6b05c30e2a8112763ec1cb0474f1f3fb93d43b8609070d0daf33f0b9fdb92196e1c5fae4213b
SSDEEP

24576:7vcPcj5w8pcoCGlopTOF+mqpWEWkDOL97iMYG:7NNVcylooLqpWEW2Uxb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	3980	WerFault.exe	51

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3980	3004	rundll32.exe	51
PID 3004 wrote to memory of 3980	3004	rundll32.exe	51
PID 3004 wrote to memory of 3980	3004	rundll32.exe	51

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sqlite3.dll,#1
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 600
    3⤵
    - Program crash
    PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3980 -ip 3980
1⤵
PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-0-0x0000000061E00000-0x0000000061EF8000-memory.dmp

Filesize
992KB

Download