9e25c89846782ebffd2814e14b232447b20df9105cdfbc5a662c721360f0c7cd

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 20:12

Target

hmc hotmail.4/H/x64/SQLite.Interop.dll
Size

1.7MB
MD5

1288823e8e1fca09bb490ce46988188d
SHA1

b07fe4a5d032296e3a7d0727216af8c1d2166e91
SHA256

6514973856d1767ccb375dcb253400e710fb4f91feb758041d8defe92b1886c5
SHA512

88967f64116951092a54118055eab462082f16676ea7565f42515e88765813b53cdfbba5181318e73b668e04ddd030a0bfcf5cf47936772f68df85488b865acd
SSDEEP

24576:xcpbyKNk5l/+ddQOJ3e4vYb0XrdhCplVv1GXOO4PmhFGYHnRELAqqU:SpbB0l/+d1c0RIJvGZ2anYqU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31
PID 2736 wrote to memory of 2748	2736	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\hmc hotmail.4\H\x64\SQLite.Interop.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 112
  2⤵
  PID:2748