9c93cd60a6108167da782ab136db0779f684b4a6cfbf6e9ac570a66c31431ac2

Analysis

max time kernel
140s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 20:08

Target

$APPDATA/HZDP/sqlite3.dll
Size

359KB
MD5

26606cf164615149ceded6385a318a77
SHA1

e61939e7163f05753a0f60de08909e98ac575e73
SHA256

81692d85c3ae268bdc5c7a46812bf87db1e0a5cc2be3c96604bb028f357a3c8d
SHA512

33ce9c6318bd3a6ebb3e95798ca2949b8f88f4144fd1098f420ccb619ba5aac87f03c713adec1d10e9b47b93e76d3ae54acd1e88e32b3d09856da9b9bf44f620
SSDEEP

6144:YP/j9kxJr2uLy4voueB8Jef2atzCXiKpii8lTtBXI3SvU0rmrwjvDSn5/NKYQAl6:4b9kxI6vXQuXiKQi8lnY36LKVN/6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4772 1872 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4772	1872	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1872	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1872	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1872	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\HZDP\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\HZDP\sqlite3.dll,#1
  2⤵
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 600
    3⤵
    - Program crash
    PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1872 -ip 1872
1⤵
PID:2240

memory/1872-0-0x0000000060900000-0x000000006094F000-memory.dmp

Filesize
316KB

Download