5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
88s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_cairo_.dll
Size

965KB
MD5

56bfb25e7e82f9f63a7b7053ee39709b
SHA1

0bf8be3fb28f3a790105202d4813ac2a142f522a
SHA256

b7838c51749679691a667ac9f41564e620adffaa221ebef2d1fc4622130d1529
SHA512

0dca9f5e19d7196ec3fc6ac647a614582cbfbcfb13bb14ffe084bb49d7aa6fc8006236480ea68d4c20c9363255462cd19c72a622157238799c1785fd0a7ce9c2
SSDEEP

24576:OFuFJU+OIbD34vsSd9oseZXNI/Fo4MAKleDqB9THgi4pvEchZ9eO5gUDn:/4doXNIp9qeEchZ9eO5g2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1952	1448	rundll32.exe	79
PID 1448 wrote to memory of 1952	1448	rundll32.exe	79
PID 1448 wrote to memory of 1952	1448	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_cairo_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_cairo_.dll,#1
  2⤵
  PID:1952