7d4564b8671eea0da70f632fc6231a0529e952782eaddbda3aa9d749e3339e5c | Triage

Resubmissions

20/08/2024, 20:56

240820-zq7cdswhnj 3

20/08/2024, 20:55

240820-zqvctswhlr 3

20/08/2024, 20:55

240820-zqgrqssgqe 3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 20:55

Sharing

Report Analysis Logs

General

Target

Executor/sqlite3.dll
Size

1.0MB
MD5

208ed4329a5a9004a54a5cc69421a557
SHA1

e85013a6a51e2e30fa17bf368172b5a110125bce
SHA256

78d7836f0e60fffc501252bdb2be5a3ddfc567c7a3f31a2d9b459621b489325b
SHA512

4feabb67bbfc5e31a519c841e9e03cc973f9037ff439960bedecbf16df96e4c6b019d6b8aa9166757b3a23e52207b1a5e90585c9ebfbc177704c3ddaefa9d381
SSDEEP

24576:4GpVRWohhfjEIoehUg2QdEYO11oNa27PB79dBYf510y:4Y5zxoFFDYO1SN/Ly10y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3056	1964	rundll32.exe	30
PID 1964 wrote to memory of 3056	1964	rundll32.exe	30
PID 1964 wrote to memory of 3056	1964	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Executor\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 80
  2⤵
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads