32b4bc7fefad278dca61055c972b0f2e0e2a7f3a25e087b85e38c895f1e7fd5c

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 08:15

Target

SQLite3.dll
Size

461KB
MD5

ddbfe57fc6827d38a751c83b95a27e35
SHA1

00f4279f4dccf3333d81cde098e522239db28f9c
SHA256

357c3dc9207400797dfd0b3bc69d047a2be6742c348f43fec3618985d9528803
SHA512

b0ab7e0db44e0c380652f2a21672158c5ea56c38bb00aa99bb361f2a23b8a1a133a4a3e01b1ca222d56a8de691bfc7fd1dc991ca399ae5305c3438ac779f2ed3
SSDEEP

6144:CpLqUHwIdjAVbqbTbNYknr1FSf1o0CgcTV2zmlJMljc7Rn1Wrudd4OESJndwzR:CpL7j8+bNYkeTxcTAwJhNd4IdwzR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	3016	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3016	2888	rundll32.exe	80
PID 2888 wrote to memory of 3016	2888	rundll32.exe	80
PID 2888 wrote to memory of 3016	2888	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SQLite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SQLite3.dll,#1
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 600
    3⤵
    - Program crash
    PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3016 -ip 3016
1⤵
PID:4764