9c93cd60a6108167da782ab136db0779f684b4a6cfbf6e9ac570a66c31431ac2

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 20:08

Target

$APPDATA/HZDP/sqlite3.dll
Size

359KB
MD5

26606cf164615149ceded6385a318a77
SHA1

e61939e7163f05753a0f60de08909e98ac575e73
SHA256

81692d85c3ae268bdc5c7a46812bf87db1e0a5cc2be3c96604bb028f357a3c8d
SHA512

33ce9c6318bd3a6ebb3e95798ca2949b8f88f4144fd1098f420ccb619ba5aac87f03c713adec1d10e9b47b93e76d3ae54acd1e88e32b3d09856da9b9bf44f620
SSDEEP

6144:YP/j9kxJr2uLy4voueB8Jef2atzCXiKpii8lTtBXI3SvU0rmrwjvDSn5/NKYQAl6:4b9kxI6vXQuXiKQi8lnY36LKVN/6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2316 1780 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2316	1780	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 1780	2196	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 2316	1780	rundll32.exe	WerFault.exe
PID 1780 wrote to memory of 2316	1780	rundll32.exe	WerFault.exe
PID 1780 wrote to memory of 2316	1780	rundll32.exe	WerFault.exe
PID 1780 wrote to memory of 2316	1780	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\HZDP\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\HZDP\sqlite3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 224
    3⤵
    - Program crash
    PID:2316

memory/1780-0-0x0000000060900000-0x000000006094F000-memory.dmp

Filesize
316KB

Download