38f1fb1d891e685a1118d70c7277488b7bc3ae9fe4ecbd5964b9a20b4fbaa23a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 01:33

Target
x86/SQLite.Interop.dll
Size 792KB
Sample240509-by1mtadf43
SHA256 3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38
MD5 9b19dcee960dc215e64b1d82348707a9
SHA1 9c1e0f76673eb385787120e17404df179316ca2b
SHA512 cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d
SSDEEP 12288:iIF0SBEkDG7/jznRefvOIVcn4PW5d6PrVJNcdwLzs9w:iIYkDG7rznRenOIVc4PW76TbK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4048	820	rundll32.exe	81
PID 820 wrote to memory of 4048	820	rundll32.exe	81
PID 820 wrote to memory of 4048	820	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll,#1
  2⤵
  PID:4048