55309a4905c0c074bb9b488a58314dc58d89dea1a8f6963a367c3a62110592c6

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 05:32

Target

resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.dll
Size

1.8MB
MD5

66a65322c9d362a23cf3d3f7735d5430
SHA1

ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256

f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA512

0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP

49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2592 wrote to memory of 1748	2592	rundll32.exe	31
PID 2592 wrote to memory of 1748	2592	rundll32.exe	31
PID 2592 wrote to memory of 1748	2592	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2592 -s 80
  2⤵
  PID:1748