09e3df6d0af19553c48a891bc78cfbf269f7ae13c9490abc975ce33f18699313 | Triage

Analysis

max time kernel
458s
max time network
1176s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04-04-2024 20:32

Sharing

Report Analysis Logs

General

Target

X2 2021 Official/sqlite3.dll
Size

628KB
MD5

2db34c7d07707168429b0b2633ff75c0
SHA1

0b29505703900208db71e8d8ae0e675fac2c4d57
SHA256

b645921e5d6ef89a1899d5cde3f3a54caec9280416290922c9d3638d3ecf49ab
SHA512

fda845b49ca94f7f2e6ca1b52819385adc46000b8cc7f7f58ca9811bbdb4e8afc3954a41a0050c4f5a44f82dc6d9c41dce38f12e81c254ce2088b139f7750d84
SSDEEP

12288:KdqTscFyl44oV1p7q5QyDYrUb+eGbOTV7KFnAzcR:KJl44Sz7iQbrPdOTJzcR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	3168	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3168	2440	rundll32.exe	78
PID 2440 wrote to memory of 3168	2440	rundll32.exe	78
PID 2440 wrote to memory of 3168	2440	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\sqlite3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\X2 2021 Official\sqlite3.dll",#1
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 448
    3⤵
    - Program crash
    PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3168 -ip 3168
1⤵
PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download