bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Sharing

Report Analysis Logs

General

Target

MedicareSign/sqlite3.dll
Size

815KB
MD5

c7f02a62ec2be3e345917640fd9e7502
SHA1

828f4df3e2ad0c8b04b06cecb0c539391ba09704
SHA256

8e85d370cc83174d34d0d6fd9153c37bb184dc9347e5a3bbfc692f9ded7be520
SHA512

d3c33df3e7e06bd2beb638a4e17703498cb49da0ce958beaf268784d802bf6069eac236deb0049b6d5b5b1ba252d15a3a0a4e8585730dc69c4604a88f9d38f8a
SSDEEP

24576:mhQAw5IR0EsV+8OCL3b1dpU1VLVrl4RXpUEYIum:m/F0EsNOCL3bL61VLVrl4f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	3784	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3784	3924	rundll32.exe	84
PID 3924 wrote to memory of 3784	3924	rundll32.exe	84
PID 3924 wrote to memory of 3784	3924	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\sqlite3.dll,#1
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 600
    3⤵
    - Program crash
    PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3784 -ip 3784
1⤵
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-0-0x0000000061E00000-0x0000000061EB8000-memory.dmp

Filesize
736KB

Download