f506ec5cb0402dd85556c5cfd38d6b5de72e8bd242aa7a2143ab1063c19f0bc2 | Triage

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:34

Sharing

Report Analysis Logs

General

Target

SQLite.dll
Size

256KB
MD5

a7535264f3d3670b0a5b5601dd1b4bec
SHA1

1884775d8febe030f594ce2eea49ca350122d3e4
SHA256

a0471887b049b2ec3ca6ded51349278da81bb7d663914825a69d255d4a37d028
SHA512

1b71e58860bd22736ef057a59c2ba3f7d52a4f6d18b9bc64299733b005905454cb42947ba5286985d8ebbd2896d4db41f815ba0a4850fa0a5b5d26c28f617d23
SSDEEP

6144:rbnTOrJirpE3uFMththU2AiqYbuYFY9Yw38cCL9Z+dU3/pZ+fyP:3qr+pE3BthWiqYbK38cm+a3/qa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2300	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2300	932	rundll32.exe	83
PID 932 wrote to memory of 2300	932	rundll32.exe	83
PID 932 wrote to memory of 2300	932	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SQLite.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SQLite.dll,#1
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 624
    3⤵
    - Program crash
    PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2300 -ip 2300
1⤵
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads