33668692ad696856f95471e2b2834d75ff6ab285fe1a5d9098d340362e127454 | Triage

Analysis

max time kernel
41s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:10

Sharing

Report Analysis Logs

General

Target

WinThruster/sqlite3.dll
Size

1.1MB
MD5

fdf0245a035f89de1af8a2091258c9ac
SHA1

78536c09808a207f45e901f14de5b038aabaede3
SHA256

6120e410ff9e5cad41b47cd5fcb23cc3f8bd8f505a86e158c578e15869489367
SHA512

4bd214bc4dbd749a429e1753c59c395344607884e20cfa3e1c0dde655e2c6c1e49ab5388e70112e83c7c71b005a985019e39bb00c1e5c1b8e90b5a3d6219e1c3
SSDEEP

24576:co0tp6E0MfgukNyOyf9OWCkdKkuyvrpSmgfWCpg7:co2ttkwBf9OFkskuyvrprF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

228 4348 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1508 wrote to memory of 4348	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 4348	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 4348	1508	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinThruster\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinThruster\sqlite3.dll,#1
2⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 600
3⤵
- Program crash
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4348 -ip 4348
1⤵
PID:2068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4348-0-0x0000000061E00000-0x0000000061EF4000-memory.dmp

Filesize
976KB

Download