1f3ac725f48f2442886bfafab79345396961c4dc15b63b9904c5a6cc0328fb8e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 09:08

Target

x64/SQLite.Interop.dll
Size

1.7MB
MD5

1288823e8e1fca09bb490ce46988188d
SHA1

b07fe4a5d032296e3a7d0727216af8c1d2166e91
SHA256

6514973856d1767ccb375dcb253400e710fb4f91feb758041d8defe92b1886c5
SHA512

88967f64116951092a54118055eab462082f16676ea7565f42515e88765813b53cdfbba5181318e73b668e04ddd030a0bfcf5cf47936772f68df85488b865acd
SSDEEP

24576:xcpbyKNk5l/+ddQOJ3e4vYb0XrdhCplVv1GXOO4PmhFGYHnRELAqqU:SpbB0l/+d1c0RIJvGZ2anYqU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2596	1472	rundll32.exe	31
PID 1472 wrote to memory of 2596	1472	rundll32.exe	31
PID 1472 wrote to memory of 2596	1472	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\SQLite.Interop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1472 -s 112
  2⤵
  PID:2596