5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_fribidi_.dll
Size

104KB
MD5

d4d4ac5ca9af9152dfc851c4232e5a54
SHA1

69752fd9b73de46e0c3128681fb786568690a319
SHA256

35eea5d9b6ce54b488f7fd93d44833eec314dac4d84f16e08c41b032b666993d
SHA512

6a3d0863f27795482b23f8dd5ea36fd2ffd2889aae99c1619b952fad0beb2ffb7b66691c294bf65c19ad1053866c77a19b823ed2195d68c362d28e65cca4953f
SSDEEP

768:YHJd9rWCvXITQYq2dRBeqO000yvhW5EJeoWVk0Ys4+42DoqZZgoRbSlSeBinymj9:Yp62kqieqO000yJQO4V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1728	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1632 wrote to memory of 1728	1632	rundll32.exe	28
PID 1728 wrote to memory of 1648	1728	rundll32.exe	29
PID 1728 wrote to memory of 1648	1728	rundll32.exe	29
PID 1728 wrote to memory of 1648	1728	rundll32.exe	29
PID 1728 wrote to memory of 1648	1728	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_fribidi_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_fribidi_.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 224
    3⤵
    - Program crash
    PID:1648

memory/1728-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download