33668692ad696856f95471e2b2834d75ff6ab285fe1a5d9098d340362e127454 | Triage

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:10

Sharing

Report Analysis Logs

General

Target

WinThruster/sqlite3.dll
Size

1.1MB
MD5

fdf0245a035f89de1af8a2091258c9ac
SHA1

78536c09808a207f45e901f14de5b038aabaede3
SHA256

6120e410ff9e5cad41b47cd5fcb23cc3f8bd8f505a86e158c578e15869489367
SHA512

4bd214bc4dbd749a429e1753c59c395344607884e20cfa3e1c0dde655e2c6c1e49ab5388e70112e83c7c71b005a985019e39bb00c1e5c1b8e90b5a3d6219e1c3
SSDEEP

24576:co0tp6E0MfgukNyOyf9OWCkdKkuyvrpSmgfWCpg7:co2ttkwBf9OFkskuyvrprF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1824 2056 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 2056	2244	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 1824	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 1824	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 1824	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 1824	2056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinThruster\sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WinThruster\sqlite3.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 224
3⤵
- Program crash
PID:1824

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x0000000061E00000-0x0000000061EF4000-memory.dmp

Filesize
976KB

Download