5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-09-2022 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_Magick++_.dll
Size

441KB
MD5

a3924e58175c07e33204d0159d39c744
SHA1

c072e70baaff7f46209faaba3b90c197a4abc8bc
SHA256

b17f189a9ae141af7e4b78f2034dee246fcfdc4061be3120367513d4eb9d6fda
SHA512

2cdbffd3415a420c25133541a44298af974f8e0975995ecfe5ab7970cfa77fc7f1d733c9c965ffe1cec3487da549dbb32dc7b1e322addb278ea96b53e5c701d0
SSDEEP

12288:wQ/hQ7R5mpWfV+Yd+vwCD6xZhqyj12+VVcz1Z+s0xrW7Zha3WOz:P7kzz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27
PID 1436 wrote to memory of 1352	1436	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_Magick++_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_Magick++_.dll,#1
  2⤵
  PID:1352

memory/1352-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download