025b1d165d48c185cbba344a25faaabf16d7313c1c079d4a99dd7cfda34c52e8

Analysis

max time kernel
94s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 12:09

Target

unlocker/SQLite3.dll
Size

336KB
MD5

ee8adfb034c7249fae8158137736582e
SHA1

7b2f35838d1ca0e7fcdb5b3564215e3b73f3da3f
SHA256

16c8c7e8cf54b53543a6b86aacacb598bb5192319fbc0496a497cf19b78a614a
SHA512

1448cbce52d14137580f893b95955fe1767fdd09544302ffd42e8e72f365b2c8fa4847a8228069b7c61bf962168e308ad56f037256a44d9e48e459c6cd0805d9
SSDEEP

6144:TICvMnOTvcfgA0qBlJ89Ojo33C1oVDtY4sG2/WctyzuYf0owFL23/:rvMnAA9BleOjoH4Ktm+jbFD3/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3844	3812	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3812	2180	rundll32.exe	82
PID 2180 wrote to memory of 3812	2180	rundll32.exe	82
PID 2180 wrote to memory of 3812	2180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unlocker\SQLite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\unlocker\SQLite3.dll,#1
  2⤵
  PID:3812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 600
    3⤵
    - Program crash
    PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 3812
1⤵
PID:1504