025b1d165d48c185cbba344a25faaabf16d7313c1c079d4a99dd7cfda34c52e8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 12:09

Target

unlocker/SQLite3.dll
Size

336KB
MD5

ee8adfb034c7249fae8158137736582e
SHA1

7b2f35838d1ca0e7fcdb5b3564215e3b73f3da3f
SHA256

16c8c7e8cf54b53543a6b86aacacb598bb5192319fbc0496a497cf19b78a614a
SHA512

1448cbce52d14137580f893b95955fe1767fdd09544302ffd42e8e72f365b2c8fa4847a8228069b7c61bf962168e308ad56f037256a44d9e48e459c6cd0805d9
SSDEEP

6144:TICvMnOTvcfgA0qBlJ89Ojo33C1oVDtY4sG2/WctyzuYf0owFL23/:rvMnAA9BleOjoH4Ktm+jbFD3/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	1240	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 1240 wrote to memory of 2368	1240	rundll32.exe	29
PID 1240 wrote to memory of 2368	1240	rundll32.exe	29
PID 1240 wrote to memory of 2368	1240	rundll32.exe	29
PID 1240 wrote to memory of 2368	1240	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unlocker\SQLite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\unlocker\SQLite3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 224
    3⤵
    - Program crash
    PID:2368