5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-09-2022 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_flif_.dll
Size

863KB
MD5

dde1e9f0c88db318e61292dd3cd52a46
SHA1

53f09d693a0b75da05a62930cb56311bd9b735d3
SHA256

4f581f52d8ae12ca8d62fc014f107330d72c9c25ca882bed0d42d21dd6955b37
SHA512

530f397874b2e4666a51aae8897e2b5e732b1464e445e0a0091d4870976e614c63e9b89e029a40c3cf858e51dc2ff1ce1c0dc9078a19690cc3ad03266ce1eeb0
SSDEEP

12288:hFL1man756aU94giMs//ERkRoP5GJPQkzH3A4zCwG5Ou+5dC9/mI4P1i:hR1mk56aU94giXPQw3A4GXk5dCO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1520	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 1520 wrote to memory of 1220	1520	rundll32.exe	28
PID 1520 wrote to memory of 1220	1520	rundll32.exe	28
PID 1520 wrote to memory of 1220	1520	rundll32.exe	28
PID 1520 wrote to memory of 1220	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_flif_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_flif_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 224
    3⤵
    - Program crash
    PID:1220

memory/1220-56-0x0000000000000000-mapping.dmp

Download
memory/1520-54-0x0000000000000000-mapping.dmp

Download
memory/1520-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download