5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
89s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_exr_.dll
Size

3.5MB
MD5

a62951bf8cf7aab24ca085ffdfa4cf82
SHA1

aea3e04c4ddc9323baf92283dca79d8f4fc1c968
SHA256

33b434ceb636bdf542cc351911daa6e5cc9a8efcb03f505ce50b6395b497dcfb
SHA512

7f1c2e4fcc03148bebd5e8ee467912c3b6f8b549915d5d7db21b713da47c7167d8f683ea6c5dd492c9931c24ab1c94c4791bf6df2e0f45724d2bb783fef8eaf3
SSDEEP

49152:4axuCVvXq/j66P/66bm1CR+0SiKHQB/c5KgGRXW3pHDd:zxuCPKgsm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4744	4816	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4816	4868	rundll32.exe	78
PID 4868 wrote to memory of 4816	4868	rundll32.exe	78
PID 4868 wrote to memory of 4816	4868	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_exr_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_exr_.dll,#1
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 604
    3⤵
    - Program crash
    PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4816 -ip 4816
1⤵
PID:3796