Analysis
-
max time kernel
137s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 21:40
Behavioral task
behavioral1
Sample
T0S8HTPUS036PVXE6D331IP0XP8F439Y50EWK.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
T0S8HTPUS036PVXE6D331IP0XP8F439Y50EWK.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
W949Z6FZAC9O47WQ28KE2V7LHZ19NB5KUK.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
W949Z6FZAC9O47WQ28KE2V7LHZ19NB5KUK.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
sqlite3.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
sqlite3.dll
Resource
win10v2004-20240508-en
General
-
Target
sqlite3.dll
-
Size
171KB
-
MD5
744dcc4cbbfbb18fe3878c4e769ec48f
-
SHA1
c1f2c56ee2d91203a01d3465f185295477a1217d
-
SHA256
33eb31a2a576e663474a895ff0190316c64a93d9ce05a55df0d53f9beeb61163
-
SHA512
706630be2ca09e574a7794e32e515a0a3f993643d034647b8cb976c1e7045e87e30362757cc65fcdb95f4a4327f0dcda3edc82ba84e5ed9115870a037e13af21
-
SSDEEP
3072:4yOtgCNPbAHuzueAlwsKmiiEHpmBt7tjBwHH1ELXvSsmB8teUOhKJz4ZKJNCT1xe:FOtRsOz2xKmGH8JBwn+2smB1Uf8Kurb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral6/memory/3408-0-0x0000000010000000-0x000000001005A000-memory.dmp upx behavioral6/memory/3408-2-0x0000000010000000-0x000000001005A000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2408 3408 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3588 wrote to memory of 3408 3588 rundll32.exe rundll32.exe PID 3588 wrote to memory of 3408 3588 rundll32.exe rundll32.exe PID 3588 wrote to memory of 3408 3588 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3408 -ip 34081⤵