e54c5e677b03867bed295acfeb35db75494eaa421e8802886a077037d791017e

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:16

Target
System.Data.SQLite.Vfs.Async/System.Data.SQLite.Vfs.Async.Test/obj/Release/System.Data.SQLite.Vfs.Async.Test.exe
Size 7KB
Sample261002-rk66fazbme
SHA256 e54c5e677b03867bed295acfeb35db75494eaa421e8802886a077037d791017e
MD5 5a071f1d94464fbd42cb98089ad05476
SHA1 ecb92724456bdc594f772e7f0c57ffe0a12144a1
SHA512 5d4fda0a49aa810f31c9cd17b2eb1196e0449d417740f200fb599c415e8ec89aa62aac797a4cb2a20d62dd6a9dad379ebf1a2faf46fc974beb288080eb9c083f
SSDEEP 96:h/y0/2SZcvajOwWg9AN5KMJYfs9TaLmInfFGnHeGZ2kttiojzNt:h6xi2Hwqb8fsYf8HDXRl
TLSH
T169F18500A3D84329D87B6F71AC73C6A006BAFA41DD76CB5F25C1114E5B61B24E8B3B75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 5556	6112	System.Data.SQLite.Vfs.Async.Test.exe	88

C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.Vfs.Async\System.Data.SQLite.Vfs.Async.Test\obj\Release\System.Data.SQLite.Vfs.Async.Test.exe
"C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.Vfs.Async\System.Data.SQLite.Vfs.Async.Test\obj\Release\System.Data.SQLite.Vfs.Async.Test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 792
  2⤵
  PID:5556

memory/6112-0-0x00007FFB4E3EA000-0x00007FFB4E3EB000-memory.dmp

Download

memory/6112-1-0x00007FFB4E0F0000-0x00007FFB4EB28000-memory.dmp

Download

memory/6112-2-0x00007FFB4E0F0000-0x00007FFB4EB28000-memory.dmp

Download

memory/6112-5-0x00007FFB4E0F0000-0x00007FFB4EB28000-memory.dmp

Download