bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Sharing

Report Analysis Logs

General

Target

MedicareSign/sqlite3.dll
Size

815KB
MD5

c7f02a62ec2be3e345917640fd9e7502
SHA1

828f4df3e2ad0c8b04b06cecb0c539391ba09704
SHA256

8e85d370cc83174d34d0d6fd9153c37bb184dc9347e5a3bbfc692f9ded7be520
SHA512

d3c33df3e7e06bd2beb638a4e17703498cb49da0ce958beaf268784d802bf6069eac236deb0049b6d5b5b1ba252d15a3a0a4e8585730dc69c4604a88f9d38f8a
SSDEEP

24576:mhQAw5IR0EsV+8OCL3b1dpU1VLVrl4RXpUEYIum:m/F0EsNOCL3bL61VLVrl4f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30
PID 2120 wrote to memory of 2632	2120	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\sqlite3.dll,#1
  2⤵
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads