5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
71s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_fribidi_.dll
Size

104KB
MD5

d4d4ac5ca9af9152dfc851c4232e5a54
SHA1

69752fd9b73de46e0c3128681fb786568690a319
SHA256

35eea5d9b6ce54b488f7fd93d44833eec314dac4d84f16e08c41b032b666993d
SHA512

6a3d0863f27795482b23f8dd5ea36fd2ffd2889aae99c1619b952fad0beb2ffb7b66691c294bf65c19ad1053866c77a19b823ed2195d68c362d28e65cca4953f
SSDEEP

768:YHJd9rWCvXITQYq2dRBeqO000yvhW5EJeoWVk0Ys4+42DoqZZgoRbSlSeBinymj9:Yp62kqieqO000yJQO4V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	3540	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3540	2212	rundll32.exe	82
PID 2212 wrote to memory of 3540	2212	rundll32.exe	82
PID 2212 wrote to memory of 3540	2212	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_fribidi_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_fribidi_.dll,#1
  2⤵
  PID:3540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 604
    3⤵
    - Program crash
    PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3540 -ip 3540
1⤵
PID:3320